Skip to content

revert: trunk-only CI gating (repo not in merge-train core set) #41

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kjgbot merged 1 commit into from
Oct 8, 2026
Merged

revert: trunk-only CI gating (repo not in merge-train core set) #41

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 1 addition & 7 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@ on:

jobs:
lint:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
name: Lint
runs-on: ubuntu-latest
steps:
Expand All @@ -28,7 +27,6 @@ jobs:
run: npm run lint

typecheck:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
name: Type Check
runs-on: ubuntu-latest
steps:
Expand All @@ -48,7 +46,6 @@ jobs:
run: npm run typecheck

test:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
name: Test (Node ${{ matrix.node-version }})
runs-on: ubuntu-latest
strategy:
Expand Down Expand Up @@ -78,7 +75,6 @@ jobs:
run: npm run test:run

build:
if: (github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk'
name: Build
runs-on: ubuntu-latest
steps:
Expand Down Expand Up @@ -107,9 +103,7 @@ jobs:
name: CI Success
needs: [lint, typecheck, test, build]
runs-on: ubuntu-latest
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') &&
(always())
if: always()
steps:
- name: Check all jobs passed
run: |
Expand Down
4 changes: 1 addition & 3 deletions .github/workflows/compact-on-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,7 @@ on:
jobs:
compact:
# Only run when PR is actually merged, not just closed
if: >-
((github.event_name != 'pull_request' && github.event_name != 'pull_request_target') || github.head_ref == 'trunk') &&
(github.event.pull_request.merged == true)
if: github.event.pull_request.merged == true

@devin-ai-integration devin-ai-integration Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Fork PR summaries cannot be pushed

When a forked PR merges, compact runs with the read-only token granted to pull_request workflows. The commit step cannot push a generated summary to main.

Learn more

A merged fork PR now passes the compact job's gate. GitHub limits the token in fork-originated pull_request workflows to read permissions unless an administrator explicitly permits write tokens. The job requests contents: write, but its commit step cannot push when compaction produced an artifact.

Example: A contributor merges a fork PR with a matching trajectory. The job creates a summary, commits it locally, then git push fails with insufficient permissions instead of saving the summary on main.

Recommended fix: Trigger the merged-PR automation through a trusted event with write access, such as pull_request_target for closed events, while checking out and executing only trusted base-branch code. Check the job's permission model for fork merges before relying on contents: write.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@devin-ai-integration devin-ai-integration Bot Oct 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Squash-merged PR trajectories go missing

When a squash-merged branch is deleted, compact cannot resolve its head SHA from the main checkout. The commit selection silently falls back to PR-number matching, which misses trajectories identified only by commits.

Learn more

The newly eligible ordinary PRs can be squash-merged and their source branches deleted. The workflow checks out main and selects original PR commits using the PR head SHA. If the head is not reachable through any fetched branch, git log fails; piping its output into paste yields an empty result without stopping the step. The fallback selects by PR number, while loadTrajectories only matches that number in a task title, description, or commit string, not in the squashed commit's history.

Example: A feature branch containing commit A is squash-merged as commit B, then deleted. A completed trajectory records A but not #41 in its task. The job cannot look up A, finds no matching PR-number text, and saves no summary.

Recommended fix: Preserve or explicitly fetch the PR head commit before it becomes unavailable, or identify the merged PR's trajectories through durable metadata that survives squash and branch deletion. Ensure failure to resolve the commit list does not silently substitute an unrelated filter.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

runs-on: ubuntu-latest

permissions:
Expand Down
17 changes: 0 additions & 17 deletions .github/workflows/trunk-guard.yml
View file
Open in desktop

This file was deleted.

Loading