Skip to content

Add Prow-style /override command for check overrides - #279

Merged
cgwalters merged 1 commit into
mainfrom
agent/override-check-command-437c9536747f5022
Oct 9, 2026
Merged

cgwalters merged 1 commit into
mainfrom
agent/override-check-command-437c9536747f5022

Conversation

@bootc-bot

@bootc-bot bootc-bot Bot commented Oct 7, 2026

Copy link
Copy Markdown
Contributor

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Summary

Implements a Prow-style /override <checkname> command that allows users with write access to manually override failing checks on pull requests.

This addresses #278 by adding a GitHub Actions workflow that:

  • Listens for PR comments starting with /override
  • Validates the commenting user has write or admin permissions
  • Creates a success check run for the specified check name
  • Provides visual feedback via comment reactions

Implementation

The workflow (override-check.yml):

  1. Triggers on issue_comment.created events for pull requests
  2. Parses the comment to extract the check name from /override <checkname>
  3. Verifies the user has write or admin access using the GitHub API
  4. Retrieves the PR's head SHA
  5. Creates a completed check run with success status
  6. Adds a 👍 reaction on success or 😕 on failure

Usage

Maintainers can comment on a PR with:

/override check-name-here

This will create a green check named "check-name-here" on the PR, useful for bypassing flaky tests or transient failures.

Validation

  • YAML syntax validated with Python's yaml parser
  • Workflow structure follows existing patterns in the repository
  • Permissions are correctly scoped (checks: write, pull-requests: read, contents: read)

Closes #278

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

  • api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by Drafter for #278 · claude · sonnet45 · 66.2 AIC · ⊞ 4.5K · ◷

Implements a GitHub Actions workflow that allows users with write access
to override failing checks on pull requests using the /override <checkname>
command in a PR comment.

The workflow:
- Triggers on PR comments starting with /override
- Validates the user has write or admin permissions
- Creates a success check run for the specified check name
- Adds reaction feedback to the comment (thumbs up on success, confused on failure)

This helps with flaky tests and other transient failures where maintainers
need to manually mark checks as passing.

Closes #278

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@bootc-bot bootc-bot Bot added agent/workflow-edits-allowed Pre-authorizes agent runs to edit protected files without the request_review gate agentic-threat-detected labels Oct 7, 2026

@bootc-bot bootc-bot Bot left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Threat detection produced a warning for this pull request output.

These changes need to be scrutinized before merge and only merged after a careful manual review.

@bootc-bot bootc-bot Bot added agent/review-working The review agent is actively working on this PR and removed agent/review-working The review agent is actively working on this PR labels Oct 7, 2026
if: |
github.event.issue.pull_request &&
startsWith(github.event.comment.body, '/override ')
runs-on: ubuntu-latest

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this one is just doing GH interactions it can use ubuntu-slim which is more efficient

@cgwalters
cgwalters marked this pull request as ready for review October 9, 2026 13:07
@cgwalters
cgwalters merged commit 3ce8f16 into main Oct 9, 2026
37 of 38 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agent/workflow-edits-allowed Pre-authorizes agent runs to edit protected files without the request_review gate agentic-threat-detected

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add a Prow-style /override <context> command

1 participant