fix(ci): prefer actor token in PR sanity #617

Merged

pdurlej merged 1 commit from codex/w6d-patchwarden-actor-token-precedence into main

2026-05-29 21:44:08 +02:00

codex commented

2026-05-29 21:34:15 +02:00

Collaborator

Canary status: local preflight green; Forgejo checks pending

Summary

This follow-up fixes the remaining Patchwarden PR sanity 403 path after #616.

The workflow now asks PR sanity to comment as codex, but pr_sanity.py still preferred the generic PLATFORMCTL_PR_SANITY_COMMENT_TOKEN before FORGEJO_TOKEN_CODEX. In environments where both are present, actor verification still used the generic Patchwarden token and failed closed.

What changed

Added a shared actor-token resolver that prefers FORGEJO_TOKEN_<ACTOR> first.
Kept the generic comment/review token as fallback only.
Applied the same rule to approved-review submission so actor verification remains consistent.
Added tests for comment and review token precedence.

Why this priority is intentional

Actor verification is the safety boundary. If the command says --comment-actor codex, the token most likely to verify as codex must win. The generic token remains available only when the actor-specific token is absent.

Validation

UV_CACHE_DIR=/private/tmp/codex-uv-cache PYTHONPATH=. uv run --project . pytest platformctl/tests/test_pr_sanity.py -q — 24 passed.
UV_CACHE_DIR=/private/tmp/codex-uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json — exitCode 0.
Local Patchwarden with Ollama Cloud model review — eligible_sanity_clean.
DeepSeek V4 Pro — OK, no findings.
GLM 5.1 — OK; requested explicit documentation of this intentional priority change, included above.

Non-goals

No runtime changes.
No secret scope changes.
No issue/comment writer changes outside the existing PR sanity path.
No bypass of actor verification.

Canary status: local preflight green; Forgejo checks pending ## Summary This follow-up fixes the remaining Patchwarden PR sanity 403 path after #616. The workflow now asks PR sanity to comment as `codex`, but `pr_sanity.py` still preferred the generic `PLATFORMCTL_PR_SANITY_COMMENT_TOKEN` before `FORGEJO_TOKEN_CODEX`. In environments where both are present, actor verification still used the generic Patchwarden token and failed closed. ## What changed - Added a shared actor-token resolver that prefers `FORGEJO_TOKEN_<ACTOR>` first. - Kept the generic comment/review token as fallback only. - Applied the same rule to approved-review submission so actor verification remains consistent. - Added tests for comment and review token precedence. ## Why this priority is intentional Actor verification is the safety boundary. If the command says `--comment-actor codex`, the token most likely to verify as `codex` must win. The generic token remains available only when the actor-specific token is absent. ## Validation - `UV_CACHE_DIR=/private/tmp/codex-uv-cache PYTHONPATH=. uv run --project . pytest platformctl/tests/test_pr_sanity.py -q` — 24 passed. - `UV_CACHE_DIR=/private/tmp/codex-uv-cache PYTHONPATH=control-plane uv run --project control-plane python -m platformctl.cli validate all --json` — exitCode 0. - Local Patchwarden with Ollama Cloud model review — `eligible_sanity_clean`. - DeepSeek V4 Pro — OK, no findings. - GLM 5.1 — OK; requested explicit documentation of this intentional priority change, included above. ## Non-goals - No runtime changes. - No secret scope changes. - No issue/comment writer changes outside the existing PR sanity path. - No bypass of actor verification.

codex added 1 commit

2026-05-29 21:34:15 +02:00

fix(ci): prefer actor token in PR sanity

python-ci / Python 3.11 (pull_request) Successful in 43s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 25s