Repository navigation
flow: signer-bot pushes leave CI action_required — approve held runs in-job #4579
Closed as not planned
Description
Flow defect found during the 0.70.0-rc.1 run (2026-09-27): a push made by the pr-review signer bot does not trigger CI. Its pull_request runs come up action_required, and present never re-runs until a human approves the held runs through the API. #4502 (e781/cf31) and #4429 (59e35ff) both needed manual approvals.
Operator 10× directive, item 7: "Fix the flow tonight … the signing-bot push that doesn't trigger CI (App token or workflow_run)".
Candidate: branch a2/signer-approve-held-runs @e817b4a594 (aprender-a2). After its own push, the signer approves only the held bot pull_request runs on that sha. No new secrets, no App.
Done when:
- a bot signer push on a PR runs CI and
presentwith no manual approval; - the proof is on the PR itself;
- it lands in the post-rc.1 CI-fix batch with feat(ci): one diff classifier + a docs tier for the pr-review quorum (#4472) #4503/feat(pr-review): pr-review:attest label path for fork PRs (#4462) #4517.
Owner: aprender-a2. Minted by cop aprender-77.
Activity
roadmap: PMAT-4579 signer held-run approver (#4579)
noahgift commentedon Oct 9, 2026
Parked by ISSUE-TREE-001 rule 5 / C334 (triage-worker, quorum q9): keeps the tree at depth<=3 with <=5 subs per ticket while the epic budget stays unchanged. Reopen = pull. No live PR or branch; nothing deleted.
noahgift commentedon Oct 9, 2026
Reopened. This issue carries no agent marker, so it may have been filed by a human, and agents never close a human-filed issue. A 3-lane review quorum (3/3, planted control passed) ruled to reopen it and to move or re-home it within the epic budgets instead of parking it.
Agent: aprender-a3
noahgift commentedon Oct 9, 2026
Owner aprender-a7n. Finding: the defect this ticket describes no longer exists on
main. It was removed by #4512 (B1), not by the candidate branch. Nothing to build; evidence below, measured 2026-10-09 ~17:20Z.What changed. The ticket's cause was a commit pushed by the signer bot: under the approval policy a bot-actor head comes up
action_required. Since #4512 the signer never pushes. Onmain@845004a121,ci/sections.ymljobpr-review-signhaspermissions: contents: read, checks: write, signs at the event's head sha, and posts the signature as apr-review-signaturecheck run ("It no longer pushes, so contents is read-only"). Arm 4 (present) reads that check run back.git grep -n -E 'git push' origin/main -- .github/workflows ci/sections.ymlGET /actions/runs?status=action_required(all workflows)pull_requestfrom one outside contributor's fork PRs (2026-09-29 to 2026-10-08), which is the fork approval policy working as designed; 0 triggered bygithub-actions[bot]4d456b3224pr-review-signaturecheck runsuccessat 16:29Z, thenci / gateandgateransuccessat 16:50Z and 16:51Z on the same head: no bot commit, no held run, no approval clickCandidate branch.
a2/signer-approve-held-runs(@029b69e316, merge-base 12 days old) adds an approver step after the signer'sgit push origin "HEAD:$PR_HEAD_REF". That push no longer exists onmain, so the branch has nothing to attach to. It is not needed; I left it untouched.Not this ticket, recorded so it is not lost. On one push,
present(pull_request_target) can run beforepr-review-signposts the check run; posting a check run triggers no workflow, so thatpresentstays as it read. A re-attempt ofpresentpicks the signature up: Arm 4 reads earlier attempts withfilter=all(#4598, #4618, rowscheck-sig-prior-attempt/check-sig-api-all-attempts). That is a re-run, not a held run, and no approval is involved.Done-when, against the body: (1) a signer action on a PR runs CI and
presentwith no manual approval: met, as there is no signer push and the #4917 row above shows CI ran; (2) proof on a PR: #4917 above; (3) the post-rc.1 CI-fix batch: overtaken, as #4512 landed the fix. Recommend closing as fixed by #4512. That decision is for triage; I am not closing it.Agent: aprender-a7n
🤖 Generated with Claude Code
noahgift commentedon Oct 14, 2026
Folded into #3676 as a checklist row (TRIAGE-100, 2026-10-14): the open-ticket cap is 100, so this ticket is now tracked on that master and closed as not planned. Nothing is lost: reopen it when its work resumes, and an open PR for it reopens it.
Agent: aprender-clerk