ci: auto-update bundle manifests on same-repo PRs#3169
Open
rm3l wants to merge 4 commits into
Open
Conversation
Update the PR bundle validation workflow to automatically regenerate and push bundle manifests when they are out of sync, using the rhdh-bot identity so the push triggers CI. For security, the auto-commit only runs on same-repo PRs (not forks). It is best-effort — if the push fails, the workflow falls through to the existing error message guiding manual remediation. Assisted-by: Claude
This reverts commit 7ac0c4d.
|
PR Summary by Qodoci: auto-update bundle manifests on same-repo PRs
AI Description
Diagram
High-Level Assessment
Files changed (1)
|
Code Review by Qodo
Context used✅ Compliance rules (platform):
18 rules 1. Push failure false-green
|
![rhdh-qodo-merge[bot]](https://avatars.githubusercontent.com/in/1961108?s=60&v=4){kind=small}
Comment on lines
+54
to
72
| - name: Auto-commit and push updated bundle manifests | ||
| # Only attempt on same-repo PRs (not forks) for security; best-effort — failure falls through to the next step | ||
| if: steps.check.outputs.changed == 'true' && github.event.pull_request.head.repo.full_name == github.repository | ||
| continue-on-error: true | ||
| run: | | ||
| git config user.name "rhdh-bot" | ||
| git config user.email "rhdh-bot@redhat.com" | ||
| git add bundle/ config/ dist/ | ||
| git commit -m "chore: regenerate bundle manifests" | ||
| git push | ||
|
|
||
| - name: Fail if bundle manifests are out of sync | ||
| if: steps.check.outputs.changed == 'true' | ||
| run: | | ||
| # Re-check in case the auto-commit step already pushed the fix | ||
| if git diff --quiet -I'^ createdAt: ' bundle config dist; then | ||
| echo "✅ Bundle manifests were auto-updated and pushed" | ||
| exit 0 | ||
| fi |
There was a problem hiding this comment.
1. Push failure false-green 🐞 Bug ≡ Correctness
The workflow commits regenerated manifests and allows git push to fail (`continue-on-error: true`), but the subsequent “Fail if…” step only checks the local working tree. If the push fails after a successful local commit, git diff becomes clean and the job exits 0 even though the PR branch is still out of sync.
Agent Prompt
### Issue description
The workflow can report success even when the auto-push fails, because it commits locally and then later validates only via `git diff` (local state), not remote state.
### Issue Context
- `continue-on-error: true` makes push failures non-fatal.
- After a successful `git commit`, `git diff` becomes clean even if `git push` failed, causing the subsequent step to incorrectly `exit 0`.
### Fix Focus Areas
- .github/workflows/pr-bundle-diff-checks.yaml[54-72]
### Suggested fix approach
1. Give the auto-commit step an `id` (e.g., `autopush`) and write an output like `pushed=true/false`.
2. If `git push` fails, undo the local commit so the next step still sees a diff and fails (or explicitly fail based on `pushed=false`).
- Example pattern inside the step:
- run `git commit ...`
- `if git push; then echo "pushed=true" >> $GITHUB_OUTPUT; else echo "pushed=false" >> $GITHUB_OUTPUT; git reset --hard HEAD~1; fi`
3. In the “Fail if…” step, only exit 0 when `steps.autopush.outputs.pushed == 'true'` (or otherwise keep failing when `changed=true`).
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Update the PR bundle validation workflow to automatically regenerate and push bundle manifests when they are out of sync. For security, the auto-commit only runs on same-repo PRs (not forks), since fork PR events don't have access to repo secrets.
The auto-commit is best-effort. If the push fails, the workflow falls through to the existing error message guiding manual remediation.
Which issue(s) does this PR fix or relate to
—
This might be helpful for tagRelease PRs like #3164
PR acceptance criteria
How to test changes / Special notes to the reviewer