pdurlej/platform

Fork 0

fix(ci): make Patchwarden client comments best effort #622

Merged

pdurlej merged 2 commits from codex/patchwarden-client-dry-run-resilience into main

2026-05-30 03:06:01 +02:00

codex commented

2026-05-30 02:47:03 +02:00

Collaborator

Canary status: pending — Forgejo checks will run on this PR.

Canary Context Pack

Product story

Patchwarden dry-run should not fail a PR when review artifacts are clean but the optional Forgejo PR comment token is rejected.

What changed

Scoped the Patchwarden client input artifact by PR number and head SHA.
Made only the final Patchwarden PR-comment posting step best-effort.
Added workflow text tests for both behaviors.

Why it changed

PR #610 showed Patchwarden client dry-run completing with no findings, then failing only while posting a comment with a prohibited token account. Artifacts should remain authoritative when comment posting is unavailable.

Files touched

.forgejo/workflows/patchwarden-client-dry-run.yml
control-plane/platformctl/tests/test_pr_sanity.py

Runtime evidence

No runtime mutation. Local validation passed: pytest test_pr_sanity.py -> 27 passed; platformctl validate all --json -> exitCode 0; git diff --check -> clean.

Known constraints

This does not make Patchwarden verdict failures non-blocking. It only makes optional Forgejo comment posting non-blocking after review artifacts exist.

Explicit out-of-scope

No runtime changes, token rotation, or issue/comment writer behavior outside this CI workflow.

Requested decision

Approve and merge if checks are green.

Merge blockers

Workflow syntax failure, dry-run/review failure before comment posting, or evidence that this hides real review failures.

Spec sources read

.forgejo/workflows/patchwarden-client-dry-run.yml — failing workflow path.
.forgejo/workflows/patchwarden-pr-sanity.yml — existing artifact-scoping pattern.
control-plane/platformctl/tests/test_pr_sanity.py — workflow behavior tests.

Canary status: pending — Forgejo checks will run on this PR. ## Canary Context Pack ### Product story Patchwarden dry-run should not fail a PR when review artifacts are clean but the optional Forgejo PR comment token is rejected. ### What changed - Scoped the Patchwarden client input artifact by PR number and head SHA. - Made only the final Patchwarden PR-comment posting step best-effort. - Added workflow text tests for both behaviors. ### Why it changed PR #610 showed Patchwarden client dry-run completing with no findings, then failing only while posting a comment with a prohibited token account. Artifacts should remain authoritative when comment posting is unavailable. ### Files touched - .forgejo/workflows/patchwarden-client-dry-run.yml - control-plane/platformctl/tests/test_pr_sanity.py ### Runtime evidence No runtime mutation. Local validation passed: pytest test_pr_sanity.py -> 27 passed; platformctl validate all --json -> exitCode 0; git diff --check -> clean. ### Known constraints This does not make Patchwarden verdict failures non-blocking. It only makes optional Forgejo comment posting non-blocking after review artifacts exist. ### Explicit out-of-scope No runtime changes, token rotation, or issue/comment writer behavior outside this CI workflow. ### Requested decision Approve and merge if checks are green. ### Merge blockers Workflow syntax failure, dry-run/review failure before comment posting, or evidence that this hides real review failures. ## Spec sources read - .forgejo/workflows/patchwarden-client-dry-run.yml — failing workflow path. - .forgejo/workflows/patchwarden-pr-sanity.yml — existing artifact-scoping pattern. - control-plane/platformctl/tests/test_pr_sanity.py — workflow behavior tests.

codex added 1 commit

2026-05-30 02:47:03 +02:00

fix(ci): make Patchwarden client comments best effort

python-ci / Python 3.11 (pull_request) Waiting to run

Details

python-ci / Python 3.12 (pull_request) Waiting to run

Details

python-ci / Python 3.13 (pull_request) Waiting to run

Details

workflow-lint / lint (pull_request) Waiting to run

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / dry-run (pull_request) Has been cancelled

Details

patchwarden-client-dry-run / collect-diff (pull_request) Has been cancelled

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / sanity (pull_request) Has been cancelled

Details

platformctl plan / auto-apply scope (pull_request) Successful in 24s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Has been cancelled

Details

canary-required / canary (pull_request) Waiting to run

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

62a1982001

codex added the

agent/codex

class/security-sensitive

kind/ops

risk/process

size/small

source/agent-generated

tier/full

labels

2026-05-30 02:47:35 +02:00

codex added 1 commit

2026-05-30 02:56:15 +02:00

chore(ci): retrigger Patchwarden client resilience checks

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 6s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 24s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 22s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 6s

Details

python-ci / Python 3.11 (pull_request) Successful in 44s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

workflow-lint / lint (pull_request) Successful in 6s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 24s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m45s

Details

canary-required / canary (pull_request) Successful in 15s

Details

a69334d0d2

codex commented

2026-05-30 03:02:08 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 622
Commit: a69334d0d2affba26ca2d9ddb431a3ce185a987c
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — .forgejo/workflows/patchwarden-client-dry-run.yml
- Evidence: .forgejo/workflows/patchwarden-client-dry-run.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
low Best-effort comment posting masks non-token failures
- Evidence: Lines 235-241 in .forgejo/workflows/patchwarden-client-dry-run.yml: if ! env ... patchwarden post-findings ... --execute; then echo ":⚠️:..."; exit 0; fi - any failure in post-findings (network, malformed artifacts, API errors) wil
- Next: Consider if this broader non-blocking behavior is acceptable, or if specific exit codes should be checked to distinguish token errors from other failures
low Test assertion for 'exit 0' is context-free
- Evidence: Line 389 in control-plane/platformctl/tests/test_pr_sanity.py: assert "exit 0" in text checks only that the string exists anywhere in the workflow file, not that it's in the correct conditional block
- Next: Consider testing for the full conditional pattern if ! env ... then ... exit 0; fi to ensure the exit 0 is in the intended context

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `622` - Commit: `a69334d0d2affba26ca2d9ddb431a3ce185a987c` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `.forgejo/workflows/patchwarden-client-dry-run.yml` - Evidence: `.forgejo/workflows/patchwarden-client-dry-run.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - **`low`** Best-effort comment posting masks non-token failures - Evidence: `Lines 235-241 in .forgejo/workflows/patchwarden-client-dry-run.yml: `if ! env ... patchwarden post-findings ... --execute; then echo "::warning::..."; exit 0; fi` - any failure in post-findings (network, malformed artifacts, API errors) wil` - Next: Consider if this broader non-blocking behavior is acceptable, or if specific exit codes should be checked to distinguish token errors from other failures - **`low`** Test assertion for 'exit 0' is context-free - Evidence: `Line 389 in control-plane/platformctl/tests/test_pr_sanity.py: `assert "exit 0" in text` checks only that the string exists anywhere in the workflow file, not that it's in the correct conditional block` - Next: Consider testing for the full conditional pattern `if ! env ... then ... exit 0; fi` to ensure the exit 0 is in the intended context ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

pdurlej approved these changes

2026-05-30 03:06:00 +02:00

pdurlej left a comment

Operator-delegated approval for nondestructive CI resilience fix. All Forgejo checks are green on expected head; local tests passed; change keeps Patchwarden artifacts authoritative when optional comment posting fails.

pdurlej merged commit 3813ffcd3e into main

2026-05-30 03:06:01 +02:00

pdurlej referenced this pull request from a commit

2026-05-30 03:06:03 +02:00

Merge pull request #622

codex referenced this pull request

2026-05-30 03:13:54 +02:00

docs(migrations): vault-to-infisical Phase 1-5 execution #64