promote-baseline: a squash-merged PR promotes on the gated head's tree (campaign template) - #143
Merged
Merged
Conversation
…tes on the gated tree The installed copy triggered on `pull_request`, whose `@refs/pull/<n>/merge` identity the promotion service account's workload-identity condition no longer admits (it pins promote-baseline.yml@refs/heads/main), required the PR head to be an ancestor of main (a squash merge's head never is), passed the head as the merge commit with no --merge-tree, and minted its App token with every permission of the installation. This is pineforge-workflow's campaign/ci/promote-baseline.yml, byte for byte, as pineforge-engine runs it: - `pull_request_target: [closed]`: main's own copy, which checks out and runs no PR code (the PR head's objects are fetched only to read its tree); - it promotes only when merge_commit_sha is on main and carries the PR head's tree, then calls `lab promote --repo codegen --merge-commit <merge_commit_sha> --head-sha <PR head> --merge-tree <tree>`, which re-reads both trees from GitHub with the job's read-only GH_TOKEN before appending the baseline; - the green check stays codegen's own: the required `gate` check-run has succeeded on the PR head and no check-run failed (paginated); - `workflow_dispatch` gains the `head_sha` input for a manual re-fire; - the org App token is scoped to pineforge-workflow, permission-contents: read. `pull_request_target` runs main's copy, so this takes effect for merges after this PR itself has merged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/workflows/promote-baseline.ymlnow takes the campaign's squash-aware template and is byte-identical tocampaign/ci/promote-baseline.ymlin pineforge-workflow (merged there as #70). Every PR ships as a squash merge, so the old exact-head workflow could never promote a codegen merge.pull_request_target(main's copy), andworkflow_dispatchgains ahead_shainput.lab promote --repo codegen --merge-commit <merge_commit_sha> --head-sha <head> --merge-tree <tree>.gatecheck-run succeeded (paginated), and no check-run failed.GH_TOKENis set on the promote step:lab promotereads both trees from GitHub, so the caller supplies no trusted tree.The file takes effect after this merges, because
pull_request_targetruns main's copy.Checks
🤖 Generated with Claude Code
https://claude.ai/code/session_01LifAW9e5J6gFx7gatuxETE