pdurlej/platform

Fork 0

fix(ci): scope Patchwarden sanity artifacts per PR #621

Merged

pdurlej merged 1 commit from codex/patchwarden-unique-artifacts into main

2026-05-30 02:11:05 +02:00

codex commented

2026-05-30 01:38:34 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Fixes Patchwarden PR sanity artifact scoping so the sanity job downloads the diff/body artifact produced for the same pull request and head SHA, instead of a stale artifact with the same shared name from another PR.

Why

PR #619 failed Patchwarden sanity because the downloaded input artifact contained PR #581 data and an empty file list/diff. The workflow used a static artifact name, which is unsafe when multiple runs share the same artifact name.

What changed

Scope the input artifact name to pull request number and head SHA.
Add a regression test that prevents returning to the static artifact name.

Validation

UV_CACHE_DIR=/private/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane pytest -q control-plane/platformctl/tests/test_pr_sanity.py => 25 passed
UV_CACHE_DIR=/private/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json => exitCode 0
git diff --check => pass

Spec sources read

docs/forgejo-agent-operations.md
.forgejo/workflows/patchwarden-pr-sanity.yml
control-plane/platformctl/tests/test_pr_sanity.py

Non-goals

Does not weaken Patchwarden.
Does not bypass checks for #619.
Does not touch runtime, secrets, Vault, or deployment state.

Canary status: missing - fire canary 3+3 manually before merge ## Summary Fixes Patchwarden PR sanity artifact scoping so the sanity job downloads the diff/body artifact produced for the same pull request and head SHA, instead of a stale artifact with the same shared name from another PR. ## Why PR #619 failed Patchwarden sanity because the downloaded input artifact contained PR #581 data and an empty file list/diff. The workflow used a static artifact name, which is unsafe when multiple runs share the same artifact name. ## What changed - Scope the input artifact name to pull request number and head SHA. - Add a regression test that prevents returning to the static artifact name. ## Validation - `UV_CACHE_DIR=/private/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane pytest -q control-plane/platformctl/tests/test_pr_sanity.py` => 25 passed - `UV_CACHE_DIR=/private/tmp/uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` => exitCode 0 - `git diff --check` => pass ## Spec sources read - `docs/forgejo-agent-operations.md` - `.forgejo/workflows/patchwarden-pr-sanity.yml` - `control-plane/platformctl/tests/test_pr_sanity.py` ## Non-goals - Does not weaken Patchwarden. - Does not bypass checks for #619. - Does not touch runtime, secrets, Vault, or deployment state.

codex added 1 commit

2026-05-30 01:38:34 +02:00

fix(ci): scope patchwarden sanity artifacts per PR

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 23s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 22s

Details

python-ci / Python 3.11 (pull_request) Successful in 42s

Details

python-ci / Python 3.12 (pull_request) Successful in 42s

Details

python-ci / Python 3.13 (pull_request) Successful in 42s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Successful in 13s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 22s

Details

base-is-main / guard (pull_request) Successful in 2s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m37s

Details

e4388bae61

codex commented

2026-05-30 01:48:52 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 621
Commit: 69540a6ce371212e3a66e85bd99949f388da10e7
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — .forgejo/workflows/patchwarden-pr-sanity.yml
- Evidence: .forgejo/workflows/patchwarden-pr-sanity.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
low Artifact name depends on PR context; may break on non-PR triggers
- Evidence: Changed file .forgejo/workflows/patchwarden-pr-sanity.yml: artifact name now uses github.event.pull_request.number and head.sha. If the workflow is triggered by a non-pull_request event (e.g., workflow_dispatch), these values will be empty,
- Next: Ensure the workflow trigger is restricted to pull_request events, or add a fallback for non-PR contexts.

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `621` - Commit: `69540a6ce371212e3a66e85bd99949f388da10e7` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/patchwarden-pr-sanity.yml` - Evidence: `.forgejo/workflows/patchwarden-pr-sanity.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - **`low`** Artifact name depends on PR context; may break on non-PR triggers - Evidence: `Changed file .forgejo/workflows/patchwarden-pr-sanity.yml: artifact name now uses github.event.pull_request.number and head.sha. If the workflow is triggered by a non-pull_request event (e.g., workflow_dispatch), these values will be empty,` - Next: Ensure the workflow trigger is restricted to pull_request events, or add a fallback for non-PR contexts. ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex added the

class/security-sensitive

label

2026-05-30 01:55:29 +02:00

pdurlej approved these changes

2026-05-30 02:01:17 +02:00

pdurlej left a comment

Operator-delegated approval via temporary admin PAT. Checks are green; Patchwarden model reviewers OK; this PR only scopes Patchwarden artifacts per PR/head SHA and is non-runtime/non-destructive.