feat(coverage-floor): use AUTOMERGE_PAT for seed PR (workflows spawn naturally)#56
Merged
Merged
Conversation
…awn naturally) The previous redesign (#55) moved the seed self-commit from the install PR into a post-merge follow-up PR — but the new PR is opened via GITHUB_TOKEN, which has the SAME recursion-prevention problem: pull _request workflows don't spawn on GITHUB_TOKEN-opened PRs. The seed PR sits "blocked" until a user pushes an empty commit to its branch. Caught on wxa_vpn#361: seed PR opened cleanly at 80.2% (measured 80.7%), but the rollup showed zero required-check runs and merge=BLOCKED. Required manual empty-commit unblock, same as the original self-commit design. Fix: forward AUTOMERGE_PAT (already deployed fleet-wide for claude-author-automerge.yml's same recursion-prevention workaround) into the reusable. Use it to push the seed branch AND to open the seed PR. PAT-opened PRs DO spawn pull_request workflows naturally — no manual unblock needed. Behavior: - AUTOMERGE_PAT present (caller forwards it): use PAT for push + PR open. Seed PR spawns all required checks normally. - AUTOMERGE_PAT absent (caller didn't forward): fall back to GITHUB_TOKEN with a clear ::warning:: that manual unblock will be needed. This makes the install still functional, just less smooth. Caller-side change: each fleet repo's coverage-floor.yml caller must forward the secret: secrets: AUTOMERGE_PAT: ${{ secrets.AUTOMERGE_PAT }} The dotclaude caller template (templates/ci-workflows/callers/ coverage-floor.yml) will be updated in a companion PR. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
|
No issues found. PAT fallback logic is correctly structured, secret masking handles the embedded-URL case, and the warning message escaping follows standard GHA practice. |
actionlint parses the secret-input description as a GitHub Actions
expression context and flags '${{ secrets.X }}' as 'context secrets
not allowed here'. Escape with '$${{ }}' so the literal renders in
the description without actionlint evaluating it.
Same fix applied to the fallback warning message (was using bash
'\${{ }}' escape which actionlint still tried to parse).
|
No blocking issues found. Core token-selection logic is correct; one cosmetic note: the |
actionlint flags `${{ secrets.X }}` inside string literals regardless
of escape attempts. Both `\${{ }}` (bash) and `$${{ }}` (GH
expression escape) still trip the parser. Simpler: don't put the literal
templating syntax in the description at all. Point readers to the caller
template in topcoder1/dotclaude for the exact syntax.
|
Coverage Floor — mode:
|
|
No issues found. Logic is sound, fallback is clean, PAT-in-URL is standard Actions practice with secret masking in place. |
topcoder1
added a commit
that referenced
this pull request
May 13, 2026
#57) ## Bug The PAT-based seed flow (#56) pushes the seed branch via PAT-embedded URL: ```bash git push -u "$PUSH_URL" "$BRANCH" ``` This sets upstream tracking to the PAT URL, not `origin`. `gh pr create` can't autodetect head from that and errors: > aborted: you must first push the current branch to a remote, or use the --head flag Caught on whois-api-llc/wxa-graph during the first end-to-end test of the new seed flow. Branch was pushed (no error); only the gh pr create step failed. ## Fix Pass `--head $BRANCH` and `--base $GITHUB_REF_NAME` explicitly. ## Manual recovery already done PR opened manually on wxa-graph (#88, branch already-pushed). Future installs use this fix. ## Auto-merge rationale ci-workflows policy — manual click after Claude Review approves. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
#55 split the seed self-commit into a post-merge follow-up PR, expecting that to bypass the GITHUB_TOKEN recursion-prevention. It didn't. The seed PR is also opened via GITHUB_TOKEN, which has the same problem — pull_request workflows don't spawn on GITHUB_TOKEN-opened PRs.
Caught on whois-api-llc/wxa_vpn#361 (seed PR opened cleanly at 80.2%, zero check runs, merge=BLOCKED). Required manual empty-commit unblock, same friction as the original.
Fix
Forward
AUTOMERGE_PAT(already deployed fleet-wide forclaude-author-automerge.yml's same recursion-prevention workaround) into the reusable. Use it to:git push -u $PUSH_URL $BRANCHwith PAT-embedded URL)gh pr createwithGH_TOKEN=$AUTOMERGE_PAT)PAT-attributed pushes/opens DO spawn pull_request workflows. No manual unblock needed.
Fallback
If caller doesn't forward
AUTOMERGE_PAT, falls back toGITHUB_TOKENwith a clear::warning::that manual unblock will be needed. Install remains functional, just less smooth.Caller-side change required
Each fleet repo's caller workflow must forward the secret:
```yaml
jobs:
coverage-floor:
uses: topcoder1/ci-workflows/.github/workflows/coverage-floor.yml@main
secrets:
AUTOMERGE_PAT: ${{ secrets.AUTOMERGE_PAT }}
```
Will update the dotclaude caller template in a companion PR.
Auto-merge rationale
Workflow file change in ci-workflows — risk:blocked, manual click required.
Plan reference
`~/.claude/plans/dotclaude-2026-05-12-install-test-ratchet.md` — Phase 3 debug iteration v2.
🤖 Generated with Claude Code