pdurlej/platform

Fork 0

fix: surface invalid automerge actor token #828

Merged

pdurlej merged 1 commit from codex/automerge-actor-token-blocked-state into main

2026-06-25 22:24:14 +02:00

codex commented

2026-06-25 22:10:38 +02:00

Collaborator

Fixes pdurlej/patchwarden#243.

What changed:

writes platform_automerge_actor_readiness.v0 for merge actor auth/identity checks;
classifies 401/403 from PLATFORM_AUTOMERGE_BOT_TOKEN as blocked_merge_actor_credential;
rejects GITHUB_TOKEN, cousin/operator identities, and the PR author as merge actors;
keeps token values and raw auth failure bodies out of logs and artifacts.

Verification:

python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py
python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_automerge_readiness.py

Fixes pdurlej/patchwarden#243. What changed: - writes `platform_automerge_actor_readiness.v0` for merge actor auth/identity checks; - classifies 401/403 from `PLATFORM_AUTOMERGE_BOT_TOKEN` as `blocked_merge_actor_credential`; - rejects `GITHUB_TOKEN`, cousin/operator identities, and the PR author as merge actors; - keeps token values and raw auth failure bodies out of logs and artifacts. Verification: - `python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py` - `python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_automerge_readiness.py`

codex added 1 commit

2026-06-25 22:10:38 +02:00

fix: surface invalid automerge actor token

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 41s

Details

python-ci / Python 3.12 (pull_request) Successful in 42s

Details

canary-required / canary (pull_request) Successful in 16s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 6m36s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

python-ci / Python 3.13 (pull_request) Successful in 44s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 18s

Details

3de844f88e

patchwarden commented

2026-06-25 22:20:53 +02:00

First-time contributor

Patchwarden PR sanity

Status: eligible_sanity_clean
PR: 828
Commit: 3de844f88e7eb746a4043d57d050f2b06f7b59f5
Security-sensitive label: missing
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: error
Verdict: -
Note: ReadTimeout: The read operation timed out
Findings: none

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `eligible_sanity_clean` - PR: `828` - Commit: `3de844f88e7eb746a4043d57d050f2b06f7b59f5` - Security-sensitive label: `missing` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `error` - Verdict: `-` - Note: ReadTimeout: The read operation timed out - Findings: none ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.