ci(auto-sync): App-token dispatch + ubuntu-latest + workflow_dispatch - #2497
Merged
Merged
Conversation
auto-sync-main-to-staging.yml hasn't fired since 2026-04-29 despite multiple staging→main promotes since. The promote PR #2442 (Phase 2) has been wedged on `mergeStateStatus: BEHIND` for hours because staging is missing the merge commit from PR #2437. Three compounding bugs, all fixed here: 1. **GitHub no-recursion suppresses the `on: push` trigger.** When the merge queue lands a staging→main promote, the resulting push to main is "by GITHUB_TOKEN", and per https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow that push event does NOT fire any downstream workflows. Verified empirically against SHA 76c604f (PR #2437): exactly ONE workflow fired on that push — `publish-workspace-server-image`, dispatched explicitly by auto-promote-staging.yml's polling tail with an App token (the documented #2357 workaround). Every other `on: push` workflow on main, including auto-sync, was silently suppressed. Same fix extended here: auto-promote-staging.yml's polling tail now ALSO dispatches `auto-sync-main-to-staging.yml --ref main` via the App token after the merge lands. App-initiated dispatch propagates `workflow_run` cascades, which is what the publish tail relies on too. Failure path: emits `::error::` with the recovery command — operator runs it once and the next promote self-heals. auto-sync.yml gains `workflow_dispatch:` so it can be invoked from the dispatch above + manually if a future promote also misses (defense in depth). 2. **`runs-on: [self-hosted, macos, arm64]` was wrong for this repo.** Comment claimed "matches the rest of this repo's workflows" — false: this is the ONLY workflow in molecule-core/.github/workflows/ with a non-ubuntu runs-on. Copy-paste artefact from molecule-controlplane (which IS private and has a Mac runner). molecule-core has no Mac runner registered, so even when the trigger DID fire (the 3 historic manual-UI merges), the job would have sat unassigned if the runner were offline. Switched to `ubuntu-latest` to match every other workflow in this repo. 3. **The `on: push` trigger remains** as a defense-in-depth path for the rare case of a manual UI merge by a real user (which uses their PAT and DOES fire downstream workflows — confirmed via the 2026-04-29 d35a242 run with `triggering_actor=HongmingWang-Rabbit` that fired 16 workflows including auto-sync). Belt-and-suspenders. Long-term: switching auto-promote's `gh pr merge --auto` call to use the App token (instead of GITHUB_TOKEN) would let `on: push` triggers fire naturally and obviate the need for the explicit dispatches in the polling tail. Tracked in #2357 — out of scope here. Operator recovery for the current Phase 2 wedge: after this lands on staging, dispatch auto-sync once via `gh workflow run auto-sync-main-to-staging.yml --ref main` to backfill the missed sync from 76c604f. PR #2442 will go from BEHIND → CLEAN and auto-merge. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
HongmingWang-Rabbit
requested a review
from hongmingwang-moleculeai
as a code owner
May 2, 2026 05:28
HongmingWang-Rabbit
enabled auto-merge
May 2, 2026 05:29
3 tasks
HongmingWang-Rabbit
pushed a commit
that referenced
this pull request
Jun 12, 2026
…ierge topbar' (#2497) from feat/canvas-org-switcher into main
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes three compounding bugs that have silently broken
auto-sync-main-to-staging.ymlsince 2026-04-30 — the workflow has only run 3 times ever (last 2026-04-29) despite multiple staging→main promotes since. Currently wedging Phase 2 promote PR #2442 onmergeStateStatus: BEHIND.Diagnosis (confirmed empirically)
GITHUB_TOKEN(merge-queue auto-merge).76c604fb(PR staging → main: auto-promote c901d52 #2437 staging→main): exactly ONE workflow fired —publish-workspace-server-image, dispatched explicitly byauto-promote-staging.yml's polling tail with an App token. Every otheron: push: branches: [main]workflow, includingauto-sync, was suppressed.auto-promote-staging.ymlfor issue auto-promote-staging uses GITHUB_TOKEN — main pushes never trigger publish/canary/redeploy chain #2357 — workaround was applied to publish but never extended to auto-sync.What this PR changes
auto-promote-staging.ymlpolling tail: after the publish dispatch, alsogh workflow run auto-sync-main-to-staging.yml --ref mainvia App token. Mirror of the existing publish dispatch — same App-token, same failure-path comment.auto-sync-main-to-staging.yml:workflow_dispatchtrigger (load-bearing for chore: rebrand icons + LICENSE cleanup + HANDOFF.md #1).runs-on: ubuntu-latest(was[self-hosted, macos, arm64]— copy-paste artefact frommolecule-controlplane;molecule-corehas no Mac runner registered, so the job would sit unassigned even when the trigger fired).on: push: [main]retained as defense-in-depth for manual-UI merges by humans (which use their PAT and DO fire downstream workflows).Recovery for the current wedge
After this lands on staging + auto-promotes to main:
gh workflow run auto-sync-main-to-staging.yml --ref mainto backfill the76c604fbgap. PR #2442 goes from BEHIND → CLEAN and self-merges.Long-term
Switch
auto-promote'sgh pr merge --autocall to use the App token (instead of GITHUB_TOKEN). That makeson: pushtriggers fire naturally and obviates the explicit dispatches. Out of scope here — tracked in #2357.Test plan
gh workflow run auto-sync-main-to-staging.yml --ref mainsucceeds and opens a sync PR🤖 Generated with Claude Code