From caec12f5f1a4763189f22b0c492a46081d065cec Mon Sep 17 00:00:00 2001
From: "bootc-bot[bot]" <225049296+bootc-bot[bot]@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:27:28 +0000
Subject: [PATCH] Add Prow-style /override command for check overrides

Implements a GitHub Actions workflow that allows users with write access
to override failing checks on pull requests using the /override <checkname>
command in a PR comment.

The workflow:
- Triggers on PR comments starting with /override
- Validates the user has write or admin permissions
- Creates a success check run for the specified check name
- Adds reaction feedback to the comment (thumbs up on success, confused on failure)

This helps with flaky tests and other transient failures where maintainers
need to manually mark checks as passing.

Closes #278

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .github/workflows/override-check.yml | 116 +++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)
 create mode 100644 .github/workflows/override-check.yml

diff --git a/.github/workflows/override-check.yml b/.github/workflows/override-check.yml
new file mode 100644
index 0000000..defa159
--- /dev/null
+++ b/.github/workflows/override-check.yml
@@ -0,0 +1,116 @@
+name: Override Check
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  override:
+    # Only run on PR comments that start with /override
+    if: |
+      github.event.issue.pull_request &&
+      startsWith(github.event.comment.body, '/override ')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      checks: write
+      pull-requests: read
+      contents: read
+    steps:
+      - name: Parse override command
+        id: parse
+        run: |
+          set -euo pipefail
+          comment_body="${{ github.event.comment.body }}"
+          # Extract check name from "/override <checkname>"
+          if [[ "$comment_body" =~ ^/override[[:space:]]+([^[:space:]]+) ]]; then
+            check_name="${BASH_REMATCH[1]}"
+            echo "check_name=$check_name" >> "$GITHUB_OUTPUT"
+            echo "Parsed check name: $check_name"
+          else
+            echo "::error::Invalid /override command format. Use: /override <checkname>"
+            exit 1
+          fi
+
+      - name: Check user permissions
+        id: check_perms
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          repo="${{ github.repository }}"
+          user="${{ github.event.comment.user.login }}"
+
+          # Check if user has write or admin permission
+          permission=$(gh api "repos/$repo/collaborators/$user/permission" --jq .permission)
+
+          echo "User $user has permission: $permission"
+
+          if [[ "$permission" == "write" || "$permission" == "admin" ]]; then
+            echo "has_write_access=true" >> "$GITHUB_OUTPUT"
+            echo "User has sufficient permissions"
+          else
+            echo "has_write_access=false" >> "$GITHUB_OUTPUT"
+            echo "::error::User $user does not have write access to override checks"
+            exit 1
+          fi
+
+      - name: Get PR head SHA
+        id: pr_info
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          pr_number="${{ github.event.issue.number }}"
+          repo="${{ github.repository }}"
+
+          head_sha=$(gh pr view "$pr_number" --repo "$repo" --json headRefOid --jq .headRefOid)
+          echo "head_sha=$head_sha" >> "$GITHUB_OUTPUT"
+          echo "PR head SHA: $head_sha"
+
+      - name: Create success check run
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          repo="${{ github.repository }}"
+          check_name="${{ steps.parse.outputs.check_name }}"
+          head_sha="${{ steps.pr_info.outputs.head_sha }}"
+          user="${{ github.event.comment.user.login }}"
+
+          # Create a check run with success status
+          gh api "repos/$repo/check-runs" \
+            -X POST \
+            -f name="$check_name" \
+            -f head_sha="$head_sha" \
+            -f status=completed \
+            -f conclusion=success \
+            -f output[title]="Override: $check_name" \
+            -f output[summary]="Check overridden by @$user via /override command"
+
+      - name: Add reaction to comment
+        if: success()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          comment_id="${{ github.event.comment.id }}"
+          repo="${{ github.repository }}"
+
+          # Add thumbs up reaction to indicate success
+          gh api "repos/$repo/issues/comments/$comment_id/reactions" \
+            -X POST \
+            -f content='+1'
+
+      - name: Add error reaction
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          comment_id="${{ github.event.comment.id }}"
+          repo="${{ github.repository }}"
+
+          # Add confused reaction to indicate failure
+          gh api "repos/$repo/issues/comments/$comment_id/reactions" \
+            -X POST \
+            -f content='confused' || true