pdurlej/platform

Fork 0

ci(patchwarden): cancel stale label retrigger runs #803

Merged

pdurlej merged 1 commit from codex/patchwarden-label-retrigger into main

2026-06-17 23:00:10 +02:00

codex commented

2026-06-17 22:04:56 +02:00

Collaborator

Canary status: operator_override — live Piotr approval present for merging this Patchwarden label-retrigger fix after targeted local verification and green Forgejo checks.

Summary

Make Patchwarden/W6d label retrigger predictable by adding per-PR concurrency to the Patchwarden-adjacent Forgejo workflows. Repeated remove/re-add label actions now replace stale runs for the same PR instead of queuing obsolete checks behind each other.

Changes

Add cancel-in-progress: true concurrency groups to base-is-main, patchwarden-pr-sanity, and patchwarden-client-dry-run.
Document the supported W6d-automerge-calibration label retrigger path.
Add a regression test that keeps the retrigger workflows on per-PR concurrency.

Verification

git diff --check
PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py
PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py tests/test_secret_recovery_verify.py
Parsed changed workflow YAML with PyYAML and confirmed the expected concurrency blocks.

Full PYTHONPATH=control-plane python3 -m pytest -q is not currently usable in this checkout: collection stops before these changes on the existing non-top-level pytest_plugins warning/error under control-plane/platformctl/tests/conftest.py and missing respx for scripts/zenbox-wordpress-mcp/tests/test_safety.py.

Test plan

Canary 3+3 fires before merge.
After merge, remove and re-add W6d-automerge-calibration on the existing Patchwarden smoke PR and confirm the latest checks supersede older pending runs.

Spec sources read

AGENTS.md — repo and Forgejo workflow operating contract.
docs/forgejo-agent-operations.md — Forgejo identity, Actions runner, and Patchwarden workflow rules.
docs/ci/README.md — CI workflow behavior and retrigger documentation target.
.forgejo/workflows/base-is-main.yml — required base guard workflow.
.forgejo/workflows/patchwarden-pr-sanity.yml — Patchwarden sanity workflow.
.forgejo/workflows/patchwarden-client-dry-run.yml — W6d/Patchwarden contract smoke workflow.
control-plane/platformctl/tests/test_pr_sanity.py — workflow contract regression tests.
control-plane/platformctl/ci/pr_sanity.py — confirmed label-sensitive deterministic findings.

Rollback

Revert this PR. That restores the previous behavior where each label event can queue its own full workflow run.

Canary status: operator_override — live Piotr approval present for merging this Patchwarden label-retrigger fix after targeted local verification and green Forgejo checks. ## Summary Make Patchwarden/W6d label retrigger predictable by adding per-PR concurrency to the Patchwarden-adjacent Forgejo workflows. Repeated remove/re-add label actions now replace stale runs for the same PR instead of queuing obsolete checks behind each other. ## Changes - Add `cancel-in-progress: true` concurrency groups to `base-is-main`, `patchwarden-pr-sanity`, and `patchwarden-client-dry-run`. - Document the supported `W6d-automerge-calibration` label retrigger path. - Add a regression test that keeps the retrigger workflows on per-PR concurrency. ## Verification - `git diff --check` - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py` - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py tests/test_secret_recovery_verify.py` - Parsed changed workflow YAML with PyYAML and confirmed the expected concurrency blocks. Full `PYTHONPATH=control-plane python3 -m pytest -q` is not currently usable in this checkout: collection stops before these changes on the existing non-top-level `pytest_plugins` warning/error under `control-plane/platformctl/tests/conftest.py` and missing `respx` for `scripts/zenbox-wordpress-mcp/tests/test_safety.py`. ## Test plan - [ ] Canary 3+3 fires before merge. - [ ] After merge, remove and re-add `W6d-automerge-calibration` on the existing Patchwarden smoke PR and confirm the latest checks supersede older pending runs. ## Spec sources read - `AGENTS.md` — repo and Forgejo workflow operating contract. - `docs/forgejo-agent-operations.md` — Forgejo identity, Actions runner, and Patchwarden workflow rules. - `docs/ci/README.md` — CI workflow behavior and retrigger documentation target. - `.forgejo/workflows/base-is-main.yml` — required base guard workflow. - `.forgejo/workflows/patchwarden-pr-sanity.yml` — Patchwarden sanity workflow. - `.forgejo/workflows/patchwarden-client-dry-run.yml` — W6d/Patchwarden contract smoke workflow. - `control-plane/platformctl/tests/test_pr_sanity.py` — workflow contract regression tests. - `control-plane/platformctl/ci/pr_sanity.py` — confirmed label-sensitive deterministic findings. ## Rollback Revert this PR. That restores the previous behavior where each label event can queue its own full workflow run.

codex added 1 commit

2026-06-17 22:04:56 +02:00

ci(patchwarden): cancel stale label retrigger runs

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 20s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 19s

Details

python-ci / Python 3.11 (pull_request) Successful in 42s

Details

python-ci / Python 3.12 (pull_request) Successful in 43s

Details

python-ci / Python 3.13 (pull_request) Successful in 42s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Successful in 15s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 1m16s

Details

d4c9238da0

patchwarden commented

2026-06-17 22:56:50 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 803
Commit: d4c9238da015439c44120d9b46d5a8de4ca0b51f
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: ABSTAIN
blocker Empty diff provided - cannot review changes
- Evidence: Diff section is empty; no file changes or hunks visible to review
- Next: Re-run review with actual diff content; current review cannot validate any changes described in PR summary

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: ABSTAIN
blocker Missing diff content
- Evidence: The diff section in the PR review request is empty; no changed files or hunks are provided.
- Next: Provide the actual diff of the changed workflow files and test code so that a meaningful review can be performed.

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: OK
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `803` - Commit: `d4c9238da015439c44120d9b46d5a8de4ca0b51f` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `ABSTAIN` - **`blocker`** Empty diff provided - cannot review changes - Evidence: `Diff section is empty; no file changes or hunks visible to review` - Next: Re-run review with actual diff content; current review cannot validate any changes described in PR summary ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `ABSTAIN` - **`blocker`** Missing diff content - Evidence: `The diff section in the PR review request is empty; no changed files or hunks are provided.` - Next: Provide the actual diff of the changed workflow files and test code so that a meaningful review can be performed. ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.

codex added the

class/security-sensitive

labels

2026-06-17 22:59:36 +02:00

codex commented

2026-06-17 22:59:46 +02:00

Author

Collaborator

Role: executor

PR-zero verification before merge:

git diff --check origin/main...HEAD -> clean.
PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py -> 44 passed.
PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -> 103 passed.
PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py tests/test_secret_recovery_verify.py -> 17 passed.

Reason to merge early in queue-collapse: this PR prevents repeated Patchwarden/W6d label retriggers from accumulating stale per-PR workflow runs.

**Role:** executor PR-zero verification before merge: - `git diff --check origin/main...HEAD` -> clean. - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py` -> 44 passed. - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_pr_sanity.py control-plane/platformctl/tests/test_automerge_readiness.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` -> 103 passed. - `PYTHONPATH=control-plane python3 -m pytest -q control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py tests/test_secret_recovery_verify.py` -> 17 passed. Reason to merge early in queue-collapse: this PR prevents repeated Patchwarden/W6d label retriggers from accumulating stale per-PR workflow runs.