[kyle-sexton]

Refs: #8425

Summary

A resumed work-resolve-issue run whose work was already committed reported done with no new commit, and the runner stopped it for a person (issue-lane run 39386636889, #8530): run-checks only checked the run's own lane branch, which a resume with no new commit does not have, so report-outcome had no check over the work and opened no PR. Every resume whose work was already done stopped the same way; resumed admissions (#8425) are held on this.

Fix

• run-checks (.github/workflows/work-resolve-issue.yml, "Pick the lane branch") checks the resumed branch when the run kept no branch, but only when lane.json's resume equals the runner-computed needs.resolve-issue.outputs.resume-branch and matches ^work-resolve-issue/issue-<this issue>-<n>-<n>$; it reaches checkout only through with: ref.
• pr-run-activity-write.yml exposes resume-branch as a workflow_call output (no trigger, input or permission change).
• report-outcome.mjs opens a PR from the resumed branch only if the check results name that branch, the branch is still at the checked tip, at least one check ran and none failed, and every commit ahead of the default branch is the lanes App's (a truncated commit list fails). The compare uses main...<checked tip>; after opening (or reusing an open App PR), a head SHA other than the checked tip closes the PR and hands the issue back.

Security pass: GitHub Security & Cost passed 84b0a4c and the F1/F2 hardening in 99c3929. Context recorded by that review: the App-commit check proves only "not a human's branch", since the model also holds the App token.

Verification

• report-outcome.test.mjs 182/182 (new tests failed first), with callers.test.mjs 197/197; actionlint clean on both workflows; pre-push check-affected passed.

Related

• fix(ci): build check-affected's uncommitted snapshot outside .git #8553 (check-affected snapshot outside .git), fix(ci): skip device nodes when check-affected stages uncommitted work #8520.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xk7Lz7d2twxvA3LfRxnLkT

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T08:09:27.666579Z	0296dbc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0296dbceeb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review reviewed 10208245e6793a1ec1e49d822e89a346a06101b1: 0 finding(s), 0 as inline comments.

Incremental review of 1020824 (since 87fb50e)

No blocking findings. I read the three changed files and the surrounding code in post-statuses.mjs and report-outcome.mjs.

I did not run the tests. The sandbox refused node --test for post-statuses.test.mjs and report-outcome.test.mjs (approval required). Treat the test results as unverified by this lane.

What the change does. A resumed run's statuses now land on the checked tip only when the same gate report-outcome applies to opening that PR passes. That gate has three parts:

• A check ran (checksPassed).
• No check failed.
• Every commit ahead of the default branch is the lanes App's (listedCommits and allLaneCommits).

The helpers are exported from report-outcome.mjs and reused. The compare call in report-outcome.mjs main and the new one in post-statuses.mjs agree:

• Both compare base...checks.tip and take default_branch from GET /repos/{repo}.
• Both use the LANES_BOT_LOGIN default melodic-automation-lanes[bot].
• Neither workflow job sets LANES_BOT_LOGIN, so both use the default.
• checks.tip goes into the compare URL unencoded, but readChecks has already checked it against ^[0-9a-f]{40}$.
• A truncated listing returns null, so allLaneCommits rejects it and the gate fails closed.

Notes, none blocking:

• In post-statuses.mjs (around lines 143–152), an API error on the default-branch or compare call now throws and the step exits 1. That only happens for a resumed run whose checks passed. The failure is closed, which is consistent with the gate.
• In report-outcome.mjs (around lines 794–800), the comment above allLaneCommits ("A resume carries every commit… passes none") now sits above the new listedCommits comment and no longer sits directly above its function. Move it back down to allLaneCommits.
• The new test matrix covers a failing check, no check, a non-App commit, a non-matching resume and no results. It does not cover a truncated listing (total_commits larger than commits.length) or an unverified commit. Both are laneCommit and listedCommits behaviours already tested through report-outcome, so I'd call this optional.

[github-actions]

claude-security-review reviewed 10208245e6793a1ec1e49d822e89a346a06101b1: 0 finding(s), 0 as inline comments.

No security findings in the incremental change since 87fb50e. I reviewed post-statuses.mjs, post-statuses.test.mjs and report-outcome.mjs from the incremental diff and the surrounding code. I did not consult the instruction exception register, because the diff changes no standing instructions.

The change tightens a gate. A resumed run's commit statuses are now posted on the resumed branch's checked tip only when all of these hold:

• lane.json's resume equals the runner's RESUME_BRANCH.
• A check ran and none failed (checksPassed).
• Every commit between the default branch and the tip is verified, authored by the lanes App bot, and committed by web-flow (allLaneCommits).

Points checked:

• Compare URL: checks.tip is validated by readChecks as 40 lowercase hex characters, and readChecks also requires the branch to match, so it can't inject into the compare path. The base is encodeURIComponent-encoded.
• Truncated listings: listedCommits returns null when the compare listing is cut short, and allLaneCommits then fails closed.
• API failures: the new github() calls throw on a non-OK response. The error goes to the existing top-level catch, so it fails the job rather than posting statuses.
• Bot login: LANES_BOT_LOGIN comes from workflow env and defaults to melodic-automation-lanes[bot].
• Ordering: moving the repo and github setup earlier changes no behavior.
• Refactor: extracting checksPassed and listedCommits keeps report-outcome's semantics.
• Tests: they cover the new rejection cases (failing check, no check run, non-App commit).