Skip to content

feat(pr-pipeline): write the lane record into pr-unblock check-run annotations and lane.json #7765

Description

@kyle-sexton

Refs: #7737

What to build

The lane record producer (component C1 of the automation-lanes never-block design). #7737 added readers for a usage-limit stop; nothing writes what they read yet, so they are inert:

  • pr-run-activity-write.yml must run ci-workflows report-lane-outcome (or an equivalent step) and put its lane record into the annotations of the posted pr-unblock check run. Today the check run carries only an output title and summary.
  • For the issue lane, the same record's class and resets must reach lane.json. The Collect the issue outcome step rewrites lane.json to {"branch":""} when the keep step did not succeed, so it must keep the class there.
  • class and resets come only from the runner's lane record, never from the model-writable work-outcome.json: a run that could write them could forge a limit stop and set its own restart time.

Consumers

  • .github/scripts/pr-unblock/limit-stop.mjs (limitResetsAt, read by dispatch.mjs and feedback-dispatch.mjs): the check-run annotation.
  • .github/scripts/work-resolve-issue/report-outcome.mjs (readLimit, the limited exit): lane.json.
  • .github/scripts/work-unblock/label-unblocked.mjs restarts on the limited marker that exit posts.

Done when

A limit-stopped pr-unblock run and a limit-stopped work-resolve-issue run each produce the record those readers parse, shown by a test or a live run.

Activity

  1. added
    needs-triageNot yet classified. Floor until a type and one priority tier are set.
    on Oct 17, 2026
  2. github-actions commented on Oct 17, 2026

    @github-actions
    Contributor

    Thanks for the writeup. I understand this as the producer-side half of the lane-record contract #7737 wired up readers for: pr-run-activity-write.yml needs to run the lane-outcome report and carry its record into the pr-unblock check-run annotations, and the issue lane's "Collect the issue outcome" step needs to preserve class/resets in lane.json instead of blanking it when the keep step didn't succeed. The security point is clear too — these fields must come only from the runner's own lane record, never from the model-writable work-outcome.json, so a run can't forge its own limit-stop reset time.

    Scope, consumers and the "done when" criteria are all spelled out, so nothing looks missing. I didn't find an existing duplicate; #7764 is a related sibling referencing the same parent issue (#7737) but covers a different component (limit settings, not the lane-record producer).

    Automated triage. A maintainer reviews it.

  3. added
    area: securitySecurity-relevant: vulnerability, hardening, or disclosure follow-up.
    on Oct 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: securitySecurity-relevant: vulnerability, hardening, or disclosure follow-up.needs-triageNot yet classified. Floor until a type and one priority tier are set.

    Fields

    No fields configured for Feature.

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions