mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-23 16:36:23 +00:00
1e01a4bbe7
#66373 swapped GITHUB_TOKEN -> AUTOFIX_BOT_PAT across the workflows. That PAT is empty on fork PRs (forks get no repo secrets), which broke every fork PR two ways: 1. detect-changes classified with the empty PAT -> the compare API failed all 3 retries -> the classifier failed open and force-enabled the ci_review lane on EVERY fork PR. 2. The ci-reviewed / mcp-catalog-reviewed label gates then read labels with the same empty PAT via a hard-failing retry step -> the job failed with no recovery a fork contributor could perform (they can't self-add the label; re-running can't fix it). Restores the pre-#66373 fork-safe behavior without reverting the commit's real improvements (job timeouts, per-file flake retry, network-install retries): - detect-changes + ci.yml: token falls back to the built-in read-only github.token when AUTOFIX_BOT_PAT is empty. On main it uses the PAT (authoritative); on forks it uses github.token, which can read the public compare endpoint. (An input `default:` only applies on omission, not on an empty passed value — hence the explicit `|| github.token`.) - lint ci-review + supply-chain mcp-catalog gates: restore the inline `gh pr view ... || true` label read with the github.token fallback, dropping the hard-failing retry "Fetch PR labels" step. Graceful degrade to "label absent" on an API blip, same as before #66373. Same-repo enforcement is unchanged (byte-identical logic; the PAT is still used there). Fork PRs classify correctly and the gates read labels via the read-only token exactly as they did before the regression.
95 lines
3.9 KiB
YAML
95 lines
3.9 KiB
YAML
name: Detect affected areas
|
|
description: >-
|
|
Classify a PR's changed files into CI work lanes (python, frontend, site,
|
|
scan, deps, mcp_catalog) so the orchestrator can conditionally call only
|
|
the sub-workflows a PR can affect. Outputs are always "true" on push/dispatch
|
|
events and fail open (everything "true") when the diff cannot be computed.
|
|
|
|
inputs:
|
|
github-token:
|
|
description: Token for the GitHub API (gh CLI). Pass secrets.AUTOFIX_BOT_PAT from the calling workflow.
|
|
required: false
|
|
default: ${{ github.token }}
|
|
|
|
outputs:
|
|
python:
|
|
description: Run Python tests / ruff / ty / windows-footguns.
|
|
value: ${{ steps.classify.outputs.python }}
|
|
frontend:
|
|
description: Run the TypeScript testing matrix + desktop build.
|
|
value: ${{ steps.classify.outputs.frontend }}
|
|
docker_meta:
|
|
description: Docker setup and meta files have changed.
|
|
value: ${{ steps.classify.outputs.docker_meta }}
|
|
site:
|
|
description: Build the Docusaurus docs site.
|
|
value: ${{ steps.classify.outputs.site }}
|
|
scan:
|
|
description: Run the supply-chain critical-pattern scanner.
|
|
value: ${{ steps.classify.outputs.scan }}
|
|
deps:
|
|
description: Check pyproject.toml dependency upper bounds.
|
|
value: ${{ steps.classify.outputs.deps }}
|
|
npm_lock:
|
|
description: Post/update the semantic package-lock.json diff PR comment.
|
|
value: ${{ steps.classify.outputs.npm_lock }}
|
|
mcp_catalog:
|
|
description: Require MCP catalog security review label.
|
|
value: ${{ steps.classify.outputs.mcp_catalog }}
|
|
ci_review:
|
|
description: Require CI-sensitive file review label.
|
|
value: ${{ steps.classify.outputs.ci_review }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Classify changed files
|
|
id: classify
|
|
shell: bash
|
|
env:
|
|
# Fall back to the built-in read-only token when the caller passes an
|
|
# empty value. Fork PRs get no repo secrets, so AUTOFIX_BOT_PAT is ""
|
|
# there, and an input `default:` only applies when the input is omitted,
|
|
# not when it's passed empty. Without this fallback the compare API
|
|
# fails on forks and the classifier fails open (every lane forced on).
|
|
GH_TOKEN: ${{ inputs.github-token || github.token }}
|
|
REPO: ${{ github.repository }}
|
|
EVENT_NAME: ${{ github.event_name }}
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# Only pull_request events are gated. Other events (push, release,
|
|
# dispatch) leave CHANGED empty, so the classifier fails open and every
|
|
# lane runs. Post-merge / on-demand validation is never weakened.
|
|
if [ "$EVENT_NAME" = "pull_request" ]; then
|
|
# Use the compare endpoint with the pinned base/head SHAs from the
|
|
# event payload instead of the "current PR files" endpoint. The SHAs
|
|
# are frozen at trigger time, so the file list is deterministic even
|
|
# if the PR receives a new push between trigger and detect.
|
|
#
|
|
# Retried: a rate-limit blip or eventual-consistency 404 on a
|
|
# freshly-pushed HEAD would otherwise silently fall open (all lanes
|
|
# run — safe, but wasteful and it masks the API failure).
|
|
CHANGED=""
|
|
for i in 1 2 3; do
|
|
if CHANGED="$(gh api \
|
|
--paginate \
|
|
"repos/${REPO}/compare/${BASE_SHA}...${HEAD_SHA}" \
|
|
--jq '.files[].filename')"; then
|
|
break
|
|
fi
|
|
if [ "$i" = 3 ]; then
|
|
echo "::warning::compare API failed after 3 attempts — failing open (all lanes run)"
|
|
CHANGED=""
|
|
break
|
|
fi
|
|
echo "::warning::compare API failed (attempt $i); retrying in 10s"
|
|
sleep 10
|
|
done
|
|
fi
|
|
|
|
echo "Changed files:"
|
|
printf '%s\n' "${CHANGED:-(none)}"
|
|
printf '%s\n' "${CHANGED:-}" | python3 scripts/ci/classify_changes.py
|