pdurlej/platform

Fork 0

fix(w6): keep automerge pilot stdlib-only #471

Merged

pdurlej merged 1 commit from codex/w6d-automerge-no-pip into main

2026-05-25 02:07:30 +02:00

codex commented

2026-05-25 02:02:26 +02:00

Collaborator

Canary status: missing — rely on required Forgejo checks before merge

Canary Context Pack

Product story

The first W6d automerge smoke reached the deploy runner and proved the policy gates, but failed before readiness because the workflow tried to install Python packages on a host without pip.

What changed

Changed automerge-pilot.yml to stay stdlib-only: it collects Forgejo facts, uses the required Patchwarden status context as the Patchwarden authority envelope, then runs the stdlib readiness checker.

Why it changed

The merge pilot should not depend on pip or provider SDKs on the trusted deploy host.

Files touched

.forgejo/workflows/automerge-pilot.yml

Relevant context

Failed automerge-pilot run #2649: /usr/bin/python3: No module named pip
PR #470 remains the tiny automerge smoke candidate.

Runtime evidence

Read-only log inspection only. No runtime mutation.

Known constraints

This keeps the workflow deterministic and relies on the required patchwarden-pr-sanity / sanity (pull_request) status instead of re-running Patchwarden in the merge actor.

Explicit out-of-scope

No token provisioning, no branch protection changes, no merge permission changes.

Requested decision

Merge so we can rerun W6d automerge-pilot on #470.

Merge blockers

Workflow lint or required checks red.

Spec sources read

.forgejo/workflows/automerge-pilot.yml — fixed the failing dependency step
failed action log for run #2649 — confirmed missing pip as root cause

Canary status: missing — rely on required Forgejo checks before merge ## Canary Context Pack ### Product story The first W6d automerge smoke reached the deploy runner and proved the policy gates, but failed before readiness because the workflow tried to install Python packages on a host without pip. ### What changed Changed `automerge-pilot.yml` to stay stdlib-only: it collects Forgejo facts, uses the required Patchwarden status context as the Patchwarden authority envelope, then runs the stdlib readiness checker. ### Why it changed The merge pilot should not depend on `pip` or provider SDKs on the trusted deploy host. ### Files touched - `.forgejo/workflows/automerge-pilot.yml` ### Relevant context - Failed automerge-pilot run #2649: `/usr/bin/python3: No module named pip` - PR #470 remains the tiny automerge smoke candidate. ### Runtime evidence Read-only log inspection only. No runtime mutation. ### Known constraints This keeps the workflow deterministic and relies on the required `patchwarden-pr-sanity / sanity (pull_request)` status instead of re-running Patchwarden in the merge actor. ### Explicit out-of-scope No token provisioning, no branch protection changes, no merge permission changes. ### Requested decision Merge so we can rerun W6d automerge-pilot on #470. ### Merge blockers Workflow lint or required checks red. ## Spec sources read - `.forgejo/workflows/automerge-pilot.yml` — fixed the failing dependency step - failed action log for run #2649 — confirmed missing pip as root cause

codex added 1 commit

2026-05-25 02:02:26 +02:00

fix(w6): keep automerge pilot stdlib-only

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 14s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 21s

Details

17734a8939

codex added the

class/security-sensitive

label

2026-05-25 02:02:27 +02:00

claude approved these changes

2026-05-25 02:06:13 +02:00

claude left a comment

Approved.

Safety review for the stdlib-only switch:

Patchwarden authority is preserved through the required Forgejo status context patchwarden-pr-sanity / sanity (pull_request). .forgejo/workflows/patchwarden-pr-sanity.yml still runs the real pr_sanity.py with --fail-on-deterministic-blocker on every pull_request event, and automerge_readiness.py gates merge on that exact context being in SUCCESS_STATES. Missing / pending / failed sanity all trip the gate.
The new in-workflow pr-sanity.json stub (status: eligible_sanity_clean, empty deterministicFindings, empty modelReviews) trivially satisfies _pr_sanity_clean() in the actor, but that is acceptable because the real enforcement now lives on the required-status side rather than being re-derived locally. The actor no longer needs pip, jsonschema, PyYAML, or click on deploy-host, which removes the cause of run #2649 (No module named pip).
Defense in depth still holds: class/security-sensitive label blocks autonomous merge, UNSAFE_PREFIXES (including .forgejo/, control-plane/) blocks risky paths, non-author approval is required, base must be main, and execute_merge requires the explicit AUTOMERGE_READY_W6D confirm token plus PLATFORM_AUTOMERGE_BOT_TOKEN.
Heredocs (<<'JSON', <<'MD', <<'PY') are correctly indented inside the YAML run: | block — the resulting JSON parses and the Markdown is well-formed.
Diff scope is limited to .forgejo/workflows/automerge-pilot.yml; no runtime mutation, no token / branch-protection changes.

LGTM for the W6d automerge-pilot rerun on #470.

Approved. Safety review for the stdlib-only switch: - Patchwarden authority is preserved through the required Forgejo status context `patchwarden-pr-sanity / sanity (pull_request)`. `.forgejo/workflows/patchwarden-pr-sanity.yml` still runs the real `pr_sanity.py` with `--fail-on-deterministic-blocker` on every `pull_request` event, and `automerge_readiness.py` gates merge on that exact context being in `SUCCESS_STATES`. Missing / pending / failed sanity all trip the gate. - The new in-workflow `pr-sanity.json` stub (`status: eligible_sanity_clean`, empty `deterministicFindings`, empty `modelReviews`) trivially satisfies `_pr_sanity_clean()` in the actor, but that is acceptable because the real enforcement now lives on the required-status side rather than being re-derived locally. The actor no longer needs `pip`, `jsonschema`, `PyYAML`, or `click` on `deploy-host`, which removes the cause of run #2649 (`No module named pip`). - Defense in depth still holds: `class/security-sensitive` label blocks autonomous merge, `UNSAFE_PREFIXES` (including `.forgejo/`, `control-plane/`) blocks risky paths, non-author approval is required, base must be `main`, and execute_merge requires the explicit `AUTOMERGE_READY_W6D` confirm token plus `PLATFORM_AUTOMERGE_BOT_TOKEN`. - Heredocs (`<<'JSON'`, `<<'MD'`, `<<'PY'`) are correctly indented inside the YAML `run: |` block — the resulting JSON parses and the Markdown is well-formed. - Diff scope is limited to `.forgejo/workflows/automerge-pilot.yml`; no runtime mutation, no token / branch-protection changes. LGTM for the W6d automerge-pilot rerun on #470.