Skip to content

fix(scheduler): preserve default-branch gate for targeted stack PRs #1197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 2 commits into from
Closed

fix(scheduler): preserve default-branch gate for targeted stack PRs #1197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7ef9be5
fix(scheduler): preserve default branch for targeted stack PRs
seonghobae Aug 21, 2026
c52d332
test(scheduler): cover stacked target base branch
seonghobae Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions .github/workflows/pr-review-merge-scheduler.yml
View file
Open in desktop

@devin-ai-integration devin-ai-integration Bot Aug 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: project_flow now derived from repository default branch

The Inspect step's project_flow selection (pr-review-merge-scheduler.yml) now switches on the repository default branch rather than the live PR base ref. For a stack PR onto a feature branch, this changes the resolved flow (e.g. a develop default now yields git-flow instead of the former github-flow fallthrough).

(Refers to this code)

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,7 @@ jobs:
{
printf 'repository=%s\n' "$GITHUB_REPOSITORY"
printf 'base_branch=%s\n' "$DEFAULT_BRANCH"
printf 'repository_default_branch=%s\n' "$DEFAULT_BRANCH"
} >>"$GITHUB_OUTPUT"
exit 0
fi
Expand Down Expand Up @@ -281,13 +282,15 @@ jobs:
live_head_repository="$(jq -r '.head.repo.full_name // empty' <<<"$pull_json")"
live_base_branch="$(jq -r '.base.ref // empty' <<<"$pull_json")"
live_head_sha="$(jq -r '.head.sha // empty' <<<"$pull_json")"
repository_default_branch="$(gh api "repos/${TARGET_REPOSITORY_INPUT}" --jq '.default_branch // empty')"
if [ "$live_number" != "$TARGET_PR_NUMBER" ] ||
[ "$live_state" != "open" ] ||
[ "$live_base_repository" != "$TARGET_REPOSITORY_INPUT" ] ||
[ "$live_head_repository" != "$TARGET_REPOSITORY_INPUT" ] ||
[ -z "$live_base_branch" ] ||
[ -z "$repository_default_branch" ] ||
! [[ "$live_head_sha" =~ ^[0-9a-fA-F]{40}$ ]]; then
printf '::error::Targeted scheduler dispatch rejected closed, cross-repository, or malformed live PR metadata. target=%s pr=%s state=%s base_repository=%s head_repository=%s base_branch=%s head_sha=%s\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "${live_state:-<missing>}" "${live_base_repository:-<missing>}" "${live_head_repository:-<missing>}" "${live_base_branch:-<missing>}" "${live_head_sha:-<missing>}"
printf '::error::Targeted scheduler dispatch rejected closed, cross-repository, or malformed live PR metadata. target=%s pr=%s state=%s base_repository=%s head_repository=%s base_branch=%s repository_default_branch=%s head_sha=%s\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "${live_state:-<missing>}" "${live_base_repository:-<missing>}" "${live_head_repository:-<missing>}" "${live_base_branch:-<missing>}" "${repository_default_branch:-<missing>}" "${live_head_sha:-<missing>}"
exit 1
fi
if [ -n "$TARGET_BASE_BRANCH_INPUT" ] &&
Expand All @@ -299,9 +302,10 @@ jobs:
{
printf 'repository=%s\n' "$TARGET_REPOSITORY_INPUT"
printf 'base_branch=%s\n' "$live_base_branch"

@devin-ai-integration devin-ai-integration Bot Aug 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: base_branch output retained only for audit

targeted_dispatch still emits base_branch, but the only consumer now reads repository_default_branch. The base_branch output survives only for validation/audit; no runtime consumer remains.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

printf 'repository_default_branch=%s\n' "$repository_default_branch"
printf 'head_sha=%s\n' "$live_head_sha"
} >>"$GITHUB_OUTPUT"
printf 'Validated exact targeted scheduler dispatch for %s#%s at %s on base %s.\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "$live_head_sha" "$live_base_branch"
printf 'Validated exact targeted scheduler dispatch for %s#%s at %s on base %s; repository default branch is %s.\n' "$TARGET_REPOSITORY_INPUT" "$TARGET_PR_NUMBER" "$live_head_sha" "$live_base_branch" "$repository_default_branch"

- name: Resolve trusted scheduler source ref
id: trusted_source
Expand Down Expand Up @@ -482,7 +486,7 @@ jobs:
env:
GH_TOKEN: ${{ secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token || github.token }}
TARGET_REPOSITORY: ${{ steps.targeted_dispatch.outputs.repository }}
TARGET_DEFAULT_BRANCH: ${{ steps.targeted_dispatch.outputs.base_branch }}
TARGET_DEFAULT_BRANCH: ${{ steps.targeted_dispatch.outputs.repository_default_branch }}
SCHEDULER_ACTIONS_TOKEN: ${{ github.event_name == 'repository_dispatch' && github.event.client_payload.target_repository != '' && (secrets.PR_REVIEW_MERGE_TOKEN || secrets.OPENCODE_APPROVE_TOKEN || steps.scheduler_app_token.outputs.token) || github.token }}
# Same-repository dispatch credential: when this scheduler runs inside
# ContextualWisdomLab/.github (the repository the required workflows are
Expand Down
20 changes: 15 additions & 5 deletions tests/test_opencode_workflow_shell_syntax.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,8 +170,17 @@ def test_merge_scheduler_targeted_dispatch_validates_live_exact_pr(tmp_path):
"""#!/usr/bin/env bash
set -euo pipefail
test "$1" = api
test "$2" = repos/ContextualWisdomLab/naruon/pulls/1179
printf '%s\\n' "$FAKE_PULL_JSON"
case "$2" in
repos/ContextualWisdomLab/naruon/pulls/1179)
printf '%s\\n' "$FAKE_PULL_JSON"
;;
repos/ContextualWisdomLab/naruon)
printf '%s\\n' 'develop'
;;
*)
exit 1
;;
esac
""",
encoding="utf-8",
)
Expand All @@ -180,7 +189,7 @@ def test_merge_scheduler_targeted_dispatch_validates_live_exact_pr(tmp_path):
"number": 1179,
"state": "open",
"base": {
"ref": "develop",
"ref": "feat/stack",
"repo": {"full_name": "ContextualWisdomLab/naruon"},
},
"head": {
Expand All @@ -199,7 +208,7 @@ def test_merge_scheduler_targeted_dispatch_validates_live_exact_pr(tmp_path):
"DEFAULT_BRANCH": "main",
"TARGET_REPOSITORY_INPUT": "ContextualWisdomLab/naruon",
"TARGET_PR_NUMBER": "1179",
"TARGET_BASE_BRANCH_INPUT": "develop",
"TARGET_BASE_BRANCH_INPUT": "feat/stack",
"ALLOWED_TARGET_REPOSITORIES": (
"ContextualWisdomLab/.github, ContextualWisdomLab/naruon"
),
Expand All @@ -217,7 +226,8 @@ def test_merge_scheduler_targeted_dispatch_validates_live_exact_pr(tmp_path):
assert accepted.returncode == 0, accepted.stderr
assert output.read_text(encoding="utf-8").splitlines() == [
"repository=ContextualWisdomLab/naruon",
"base_branch=develop",
"base_branch=feat/stack",
"repository_default_branch=develop",
"head_sha=4afd4af7ad343660356791873d940aa2846f40c2",
]

Expand Down
4 changes: 3 additions & 1 deletion tests/test_required_workflow_queue_contract.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,8 @@ def test_targeted_scheduler_dispatch_is_allowlisted_and_exact_pr_scoped() -> Non
assert "TARGET_REPOSITORY_INPUT:" in validation
assert "TARGET_PR_NUMBER:" in validation
assert "TARGET_BASE_BRANCH_INPUT:" in validation
assert "repository_default_branch=\"$(gh api \"repos/${TARGET_REPOSITORY_INPUT}\" --jq '.default_branch // empty')\"" in validation
assert "repository_default_branch=%s\\n" in validation
assert (
"ALLOWED_TARGET_REPOSITORIES: ${{ "
"vars.OPENCODE_REPOSITORY_DISPATCH_TARGETS }}"
Expand All @@ -79,7 +81,7 @@ def test_targeted_scheduler_dispatch_is_allowlisted_and_exact_pr_scoped() -> Non
assert "Targeted scheduler dispatch base branch does not match the live PR" in validation
assert "TARGET_REPOSITORY: ${{ steps.targeted_dispatch.outputs.repository }}" in inspect
assert (
"TARGET_DEFAULT_BRANCH: ${{ steps.targeted_dispatch.outputs.base_branch }}"
"TARGET_DEFAULT_BRANCH: ${{ steps.targeted_dispatch.outputs.repository_default_branch }}"
in inspect
)
assert '--repo "$TARGET_REPOSITORY"' in inspect
Expand Down
Loading