fix(ci): align Patchwarden comment actor token #578

Merged

pdurlej merged 1 commit from codex/w6d-merge-friction into main

2026-05-28 23:13:46 +02:00

codex commented

2026-05-28 23:09:14 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Summary

Fixes W6d merge-friction around Patchwarden PR sanity comments. PR #527 had a required patchwarden-pr-sanity / sanity check fail after the deterministic/model path was already clean because the optional comment side-effect failed actor verification with HTTP 403.

This keeps Patchwarden advisory/sanity behavior narrow: no automerge, no runtime mutation, no issue/comment writer expansion beyond the existing PR sanity comment path.

Evidence

Read-only inspection of PR #527 run 2705 showed:

[pr-sanity] comment failed: comment actor verification failed: HTTP 403

The PR already had an earlier patchwarden-pr-sanity comment for the prior commit, so the failure was isolated to comment actor/token alignment on the latest run, not to deterministic blockers.

What changed

PLATFORMCTL_PR_SANITY_COMMENT_TOKEN now maps to PLATFORMCTL_PR_SANITY_COMMENT_ACTOR, defaulting to patchwarden.
FORGEJO_TOKEN_CODEX remains mapped to codex.
platformctl now accepts --comment-actor patchwarden.
Review submission retries Forgejo/Gitea-style APPROVE if the GitHub-style APPROVED enum is rejected.
Added tests for actor mapping, patchwarden actor acceptance, and review-event fallback.

Safety

Deterministic blockers unchanged.
--fail-on-deterministic-blocker unchanged.
No automerge behavior added.
No runtime mutation.
No secrets printed.
This only fixes comment/review side-effect compatibility for existing Patchwarden PR sanity.

Validation

UV_CACHE_DIR=/private/tmp/platform-uv-cache uv run pytest platformctl/tests/test_pr_sanity.py => 22 passed
UV_CACHE_DIR=/private/tmp/platform-uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json => exit 0
git diff --check => pass
Kimi sanity check => OK, with residual config/integration risks noted around token scope and Forgejo event enum behavior.

Spec sources read

.forgejo/workflows/patchwarden-pr-sanity.yml
control-plane/platformctl/ci/pr_sanity.py
control-plane/platformctl/tests/test_pr_sanity.py
runbooks/forgejo-actions-runner.md sections around Patchwarden PR sanity / mobile merge assist
PR #527 run 2705 log, read-only

Supports mobile merge friction reduction for PR #527 and the W6d Patchwarden/Ollama lane.
Does not close PR #527; that PR is a live calibration target.

Canary status: missing - fire canary 3+3 manually before merge ## Summary Fixes W6d merge-friction around Patchwarden PR sanity comments. PR #527 had a required `patchwarden-pr-sanity / sanity` check fail after the deterministic/model path was already clean because the optional comment side-effect failed actor verification with HTTP 403. This keeps Patchwarden advisory/sanity behavior narrow: no automerge, no runtime mutation, no issue/comment writer expansion beyond the existing PR sanity comment path. ## Evidence Read-only inspection of PR #527 run 2705 showed: ```text [pr-sanity] comment failed: comment actor verification failed: HTTP 403 ``` The PR already had an earlier `patchwarden-pr-sanity` comment for the prior commit, so the failure was isolated to comment actor/token alignment on the latest run, not to deterministic blockers. ## What changed - `PLATFORMCTL_PR_SANITY_COMMENT_TOKEN` now maps to `PLATFORMCTL_PR_SANITY_COMMENT_ACTOR`, defaulting to `patchwarden`. - `FORGEJO_TOKEN_CODEX` remains mapped to `codex`. - `platformctl` now accepts `--comment-actor patchwarden`. - Review submission retries Forgejo/Gitea-style `APPROVE` if the GitHub-style `APPROVED` enum is rejected. - Added tests for actor mapping, patchwarden actor acceptance, and review-event fallback. ## Safety - Deterministic blockers unchanged. - `--fail-on-deterministic-blocker` unchanged. - No automerge behavior added. - No runtime mutation. - No secrets printed. - This only fixes comment/review side-effect compatibility for existing Patchwarden PR sanity. ## Validation - `UV_CACHE_DIR=/private/tmp/platform-uv-cache uv run pytest platformctl/tests/test_pr_sanity.py` => 22 passed - `UV_CACHE_DIR=/private/tmp/platform-uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` => exit 0 - `git diff --check` => pass - Kimi sanity check => OK, with residual config/integration risks noted around token scope and Forgejo event enum behavior. ## Spec sources read - `.forgejo/workflows/patchwarden-pr-sanity.yml` - `control-plane/platformctl/ci/pr_sanity.py` - `control-plane/platformctl/tests/test_pr_sanity.py` - `runbooks/forgejo-actions-runner.md` sections around Patchwarden PR sanity / mobile merge assist - PR #527 run 2705 log, read-only ## Related - Supports mobile merge friction reduction for PR #527 and the W6d Patchwarden/Ollama lane. - Does not close PR #527; that PR is a live calibration target.

codex added this to the 06 - Agent execution and CI governance milestone

2026-05-28 23:09:14 +02:00

codex added the

kind/chore

class/security-sensitive

labels

2026-05-28 23:09:14 +02:00

codex added 1 commit