fix(ci): export MERGE_BASE in patchwarden-client-dry-run step #528

Merged

pdurlej merged 1 commit from claude/fix-dry-run-merge-base-export into main

2026-05-27 23:00:31 +02:00

claude commented

2026-05-27 23:00:04 +02:00

Collaborator

Root cause

The dry-run job in patchwarden-client-dry-run.yml failed deterministically at exactly 21 s with:

Traceback (most recent call last):
  File "<stdin>", line 35, in <module>
  File "<frozen os>", line 714, in __getitem__
KeyError: 'MERGE_BASE'

The bash line MERGE_BASE="$(cat /tmp/patchwarden-client/merge-base.txt)" creates a shell-local variable. The subsequent python3 - <<'PY' heredoc launches a child process, and un-exported shell vars do not propagate to its os.environ. The Python metadata writer therefore crashes before patchwarden review-run is invoked, so no Ollama call happens and no comment is posted.

Fix (1 char)

-          MERGE_BASE="$(cat /tmp/patchwarden-client/merge-base.txt)"
+          export MERGE_BASE="$(cat /tmp/patchwarden-client/merge-base.txt)"

--merge-base-sha "$MERGE_BASE" on the same step's patchwarden pr-check invocation keeps working unchanged — bash already saw the var; only the Python child process needed it via env.

Evidence

pdurlej/platform#527 (W6d smoke target): run 2659 (initial PR open) failed 21 s, run 2664 (after synchronize from empty commit) failed 21 s — identical timing and traceback.
Full log line 170-173 in patchwarden-client-dry-run-dry-run-4631.log from run 2664 / job 1.
Pre-merge validation locally:
- python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --json /tmp/lint-result.json → 0 findings
- python3 -c "import yaml; yaml.safe_load(open('.forgejo/workflows/patchwarden-client-dry-run.yml'))" → OK

Out of scope (observed in same log, NOT addressed here)

PLATFORMCTL_CANARY_ENV missing on runner — ::notice::No runner-local canary env found; Patchwarden model review may fail closed. Even with MERGE_BASE fixed, review-run will exit 2 fail-closed unless runner env provides the canary token. Separate runner-config concern.
Workflow trigger types lack labeled / ready_for_review — on: pull_request: types: [opened, synchronize, reopened] means adding the W6d-automerge-calibration label or marking a draft ready does not re-trigger the workflow. Worked around in #527 via empty-commit synchronize. Worth a separate follow-up (with a label-name filter to avoid spam on every label change) — but I left it out of this PR to keep the diff to its single root-cause fix.
No Patchwarden CLI changes — this is pure platform workflow plumbing.

Smoke after merge

pdurlej/platform#527 is the standing smoke target (still labeled W6d-automerge-calibration). After this PR lands, re-run the dry-run job on #527 (or push another empty commit). Expected progression:

MERGE_BASE KeyError gone (review-run is reachable)
review-run either succeeds with Ollama findings, or exits 2 with soft_fail_review_unreliable per pdurlej/patchwarden#54 (canary env still missing)
If review-run succeeds, post-findings --execute posts a single Patchwarden comment

Refs: pdurlej/platform#524, pdurlej/platform#527, pdurlej/patchwarden#49 #50 #54

## Root cause The `dry-run` job in `patchwarden-client-dry-run.yml` failed deterministically at exactly 21 s with: ``` Traceback (most recent call last): File "<stdin>", line 35, in <module> File "<frozen os>", line 714, in __getitem__ KeyError: 'MERGE_BASE' ``` The bash line `MERGE_BASE="$(cat /tmp/patchwarden-client/merge-base.txt)"` creates a shell-local variable. The subsequent `python3 - <<'PY'` heredoc launches a child process, and un-exported shell vars do not propagate to its `os.environ`. The Python metadata writer therefore crashes before `patchwarden review-run` is invoked, so no Ollama call happens and no comment is posted. ## Fix (1 char) ```diff - MERGE_BASE="$(cat /tmp/patchwarden-client/merge-base.txt)" + export MERGE_BASE="$(cat /tmp/patchwarden-client/merge-base.txt)" ``` `--merge-base-sha "$MERGE_BASE"` on the same step's `patchwarden pr-check` invocation keeps working unchanged — bash already saw the var; only the Python child process needed it via env. ## Evidence - `pdurlej/platform#527` (W6d smoke target): run 2659 (initial PR open) failed 21 s, run 2664 (after `synchronize` from empty commit) failed 21 s — identical timing and traceback. - Full log line 170-173 in `patchwarden-client-dry-run-dry-run-4631.log` from run 2664 / job 1. - Pre-merge validation locally: - `python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --json /tmp/lint-result.json` → 0 findings - `python3 -c "import yaml; yaml.safe_load(open('.forgejo/workflows/patchwarden-client-dry-run.yml'))"` → OK ## Out of scope (observed in same log, NOT addressed here) - **`PLATFORMCTL_CANARY_ENV` missing on runner** — `::notice::No runner-local canary env found; Patchwarden model review may fail closed.` Even with MERGE_BASE fixed, `review-run` will exit 2 fail-closed unless runner env provides the canary token. Separate runner-config concern. - **Workflow trigger types lack `labeled` / `ready_for_review`** — `on: pull_request: types: [opened, synchronize, reopened]` means adding the `W6d-automerge-calibration` label or marking a draft ready does not re-trigger the workflow. Worked around in #527 via empty-commit `synchronize`. Worth a separate follow-up (with a label-name filter to avoid spam on every label change) — but I left it out of this PR to keep the diff to its single root-cause fix. - **No Patchwarden CLI changes** — this is pure platform workflow plumbing. ## Smoke after merge `pdurlej/platform#527` is the standing smoke target (still labeled `W6d-automerge-calibration`). After this PR lands, re-run the `dry-run` job on #527 (or push another empty commit). Expected progression: 1. `MERGE_BASE` KeyError gone (`review-run` is reachable) 2. `review-run` either succeeds with Ollama findings, or exits 2 with `soft_fail_review_unreliable` per `pdurlej/patchwarden#54` (canary env still missing) 3. If `review-run` succeeds, `post-findings --execute` posts a single Patchwarden comment Refs: `pdurlej/platform#524`, `pdurlej/platform#527`, `pdurlej/patchwarden#49 #50 #54`

claude added 1 commit

2026-05-27 23:00:04 +02:00

fix(ci): export MERGE_BASE in patchwarden-client-dry-run step

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 6s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

workflow-lint / lint (pull_request) Successful in 6s

Details

canary-required / canary (pull_request) Successful in 14s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 22s

Details

patchwarden-pr-sanity / sanity (pull_request) Failing after 23s

Details

8a4480fdd6

The dry-run job failed deterministically at 21s with
`KeyError: 'MERGE_BASE'` because the bash line
`MERGE_BASE="$(cat ...)"` created a shell-local variable that
did not propagate to the subsequent `python3 - <<'PY'` child
process. Adding `export` fixes propagation to os.environ.

Evidence: pdurlej/platform#527 dry-run job (runs 2659 + 2664,
both failed at exactly 21s, log line 170-173 with traceback).

Out of scope (separate concerns observed in same log, not
addressed here):
- PLATFORMCTL_CANARY_ENV missing on runner (Ollama would
  still fail-closed without it)
- Workflow trigger types don't include labeled/ready_for_review
  (#527 needed empty-commit workaround for re-run)

Refs: pdurlej/platform#524, pdurlej/platform#527

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>