Repository navigation
Automate CI refresh after verified Nix hash commits #177
Description
Follow-up discovered while validating Dependabot PRs #175 and #176 after #173.
The Nix helper correctly rebuilds and smoke-tests the dependency hash, then the updater commits flake.nix using GITHUB_TOKEN. GitHub suppresses normal workflow triggers from those token-created pushes, so the updated PR head does not automatically receive fresh Test/Lint/build checks.
Observed on #175: the updater created head 37d0e01 while dependency CI was still associated with the preceding head. The final-head statusCheckRollup was empty. A maintainer close/reopen cycle successfully triggered full validation on the final head.
Tasks:
- Choose a secure way to trigger validation on the final verified-hash head, or restructure hash updates so the ordinary PR checks validate the final commit automatically.
- Preserve read-only behavior for fork PRs and avoid privileged execution of untrusted PR code.
- Prevent bot-trigger loops and duplicate unnecessary builds.
- Document any required credentials or maintainer workflow, with regression coverage for the trigger behavior where practical.
Acceptance: dependency PRs finish with current checks on their actual final commit without a manual close/reopen cycle. The existing hash verification itself is working; this tracks the remaining orchestration improvement.
Activity
Refresh CI after verified Nix hash commits (#177)
devnullvoid commentedon Nov 3, 2026
Implementation pushed to develop in 4b88c4b. After a verified hash commit, an API-only job publishes Nix / Verified hash on its exact SHA and dispatches ci.yml using GITHUB_TOKEN. The job excludes forks, requires an actual auto-commit, and skips stale branch heads; it never checks out PR code or dispatches the Nix updater recursively. No new secrets are required.
Local build, full tests, code-quality checks, workflow lint, and mocked API regression cases passed. Default-branch trigger registration is isolated in #179 (one-line CI-only change). Next is an end-to-end test on #178, deliberately seeding the old hash and requiring checks on the bot-created final commit before merging. Keeping this issue open until that test succeeds.
Enable explicit CI dispatch on the default branch (#177) (#179)
Exercise automatic final-commit CI for the dependency update
Report dispatched CI results in the PR summary (#177)
Validate visible final-commit CI reporting (#177)
devnullvoid commentedon Nov 3, 2026
Live validation found an additional GitHub behavior: dispatched jobs were present in the commit REST check-runs API but absent from the PR GraphQL rollup, leaving only the green Nix status visible. Follow-up 9f76477 adds a pending CI / Final commit status before dispatch and an API-only CI reporting job, gated on all lint/test/build results. Mocked regression cases cover success, failure, skipped/cancelled builds, missing/invalid results, and API errors.
The second seeded-hash test repaired the hash and created e448f1a. The PR rollup now correctly shows Nix success plus CI pending. Automatic final-head CI is running at https://github.com/devnullvoid/pvetui/actions/runs/41581060744. Waiting for completion before closing.
devnullvoid commentedon Nov 3, 2026
Implemented on develop in 4b88c4b and 9f76477, with default-branch dispatch registration merged via #179. Verified end to end on #178, now merged into develop as 83275bf.
The updater repaired the deliberately stale hash, rebuilt and smoke-tested the binary, committed e448f1a, and automatically dispatched CI on that exact final SHA. Test, Lint, all three platform builds, and final-status reporting passed: https://github.com/devnullvoid/pvetui/actions/runs/41581060744. The PR-visible final-CI status stayed pending until completion, then became success. No manual close/reopen, rerun, or workflow dispatch was needed.
Fork validation remains read-only. Both write-permission orchestration jobs are API-only with no checkout; no new secrets are required. A current hash does not dispatch another CI run, the updater is never dispatched recursively, and stale branch heads are skipped. README, AGENTS, changelog, and regression tests cover the behavior and error paths.
GitHub may retain empty action_required placeholders for suppressed bot-triggered PR runs; the explicit final-commit statuses link to the actual verified runs and are the PR-visible result.