feat(auto-rebase): trigger Claude agentic rebase on merge conflict #280
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,55 @@ | ||||||||||||
| # Quality gates for the auto-rebase workflow and its supporting scripts. | ||||||||||||
| # | ||||||||||||
| # Triggered on any PR that touches: | ||||||||||||
| # - .github/workflows/auto-rebase*.yml | ||||||||||||
| # - scripts/auto-rebase.sh | ||||||||||||
| # - test/workflows/auto-rebase/** | ||||||||||||
| # | ||||||||||||
| # Gates (all must pass before merge): | ||||||||||||
| # 1. shellcheck — static analysis of scripts/auto-rebase.sh | ||||||||||||
| # 2. bats — unit test suite for conflict-handling logic | ||||||||||||
|
|
||||||||||||
| name: Auto-Rebase Tests | ||||||||||||
|
|
||||||||||||
| on: | ||||||||||||
| pull_request: | ||||||||||||
| paths: | ||||||||||||
| - '.github/workflows/auto-rebase*.yml' | ||||||||||||
| - 'scripts/auto-rebase.sh' | ||||||||||||
| - 'test/workflows/auto-rebase/**' | ||||||||||||
| push: | ||||||||||||
| branches: | ||||||||||||
| - main | ||||||||||||
| paths: | ||||||||||||
| - '.github/workflows/auto-rebase*.yml' | ||||||||||||
| - 'scripts/auto-rebase.sh' | ||||||||||||
| - 'test/workflows/auto-rebase/**' | ||||||||||||
|
|
||||||||||||
| permissions: | ||||||||||||
| contents: read | ||||||||||||
|
|
||||||||||||
| concurrency: | ||||||||||||
| group: auto-rebase-tests-${{ github.ref }}-${{ github.sha }} | ||||||||||||
| cancel-in-progress: true | ||||||||||||
|
Comment on lines
+32
to
+33
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial | ⚡ Quick win Make concurrency key branch/PR-scoped (not SHA-scoped). Using Proposed fix concurrency:
- group: auto-rebase-tests-${{ github.ref }}-${{ github.sha }}
+ group: auto-rebase-tests-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||
|
|
||||||||||||
| jobs: | ||||||||||||
| test: | ||||||||||||
| name: ShellCheck and bats | ||||||||||||
| runs-on: ubuntu-latest | ||||||||||||
| timeout-minutes: 10 | ||||||||||||
| steps: | ||||||||||||
| - name: Checkout repository | ||||||||||||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||||||||||||
| with: | ||||||||||||
| fetch-depth: 1 | ||||||||||||
|
|
||||||||||||
| - name: Install bats and shellcheck | ||||||||||||
| run: | | ||||||||||||
| sudo apt-get update -qq | ||||||||||||
| sudo apt-get install -y --no-install-recommends bats shellcheck | ||||||||||||
|
|
||||||||||||
| - name: ShellCheck | ||||||||||||
| run: shellcheck --severity=warning scripts/auto-rebase.sh | ||||||||||||
|
|
||||||||||||
| - name: Run bats suite | ||||||||||||
| run: bats --print-output-on-failure test/workflows/auto-rebase/ | ||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| #!/usr/bin/env bash | ||
| # auto-rebase.sh — conflict-handling helpers for the auto-rebase workflow. | ||
| # Called from .github/workflows/auto-rebase-reusable.yml. | ||
| # | ||
| # All functions read REPO from the environment and accept explicit arguments | ||
| # for the values that vary per PR, making them unit-testable. | ||
| # | ||
| # Required env: GH_TOKEN, REPO | ||
| set -euo pipefail | ||
|
|
||
| # Post the "blocked by workflows permission" comment (idempotent). | ||
| # Returns 0 whether it posts or skips. | ||
| handle_permissions_block() { | ||
| local pr_number="$1" | ||
| local base_branch="$2" | ||
|
|
||
| local sentinel="<!-- auto-rebase-blocked -->" | ||
| local already_posted | ||
| already_posted=$(gh pr view "$pr_number" --repo "$REPO" \ | ||
| --json comments --jq "[.comments[] | select(.body | contains(\"$sentinel\"))] | length") | ||
| if [[ "$already_posted" -gt 0 ]]; then | ||
| echo " Skipping — blocked comment already posted" | ||
| return 0 | ||
| fi | ||
|
|
||
| echo " Posting manual-rebase request (workflows permission missing)" | ||
| local body="$sentinel" | ||
| body+=$'\n'"**Auto-rebase blocked** — the base branch contains \`.github/workflows/\` changes" | ||
| body+=" that require the \`workflows\` permission to merge into this branch," | ||
| body+=" but the auto-rebase workflow's token does not have that permission." | ||
| body+=$'\n\n'"Please rebase this branch manually:" | ||
| body+=$'\n'"\`\`\`"$'\n'"git fetch origin" | ||
| body+=$'\n'"git rebase origin/$base_branch" | ||
| body+=$'\n'"git push --force-with-lease"$'\n'"\`\`\`" | ||
| gh pr comment "$pr_number" --repo "$REPO" --body "$body" | ||
| } | ||
|
|
||
| # Post a SHA-keyed conflict sentinel comment and fire a repository_dispatch | ||
| # event to trigger the claude-rebase job. Idempotent: skips if a comment with | ||
| # this exact sentinel (tied to the current base-branch HEAD SHA) already exists, | ||
| # so a new merge to the base branch resets the gate and allows Claude another attempt. | ||
| handle_conflict() { | ||
| local pr_number="$1" | ||
| local head_ref="$2" | ||
| local base_branch="$3" | ||
|
|
||
| # First 8 chars of the base branch HEAD SHA — changes with every merge. | ||
| local base_sha | ||
| base_sha=$(gh api "repos/$REPO/branches/$base_branch" --jq '.commit.sha' | cut -c1-8) | ||
|
|
||
| # Sentinel is SHA-keyed so a new main commit resets idempotency for that PR. | ||
| local sentinel="<!-- auto-rebase-conflict:$base_sha -->" | ||
| local already_posted | ||
| already_posted=$(gh pr view "$pr_number" --repo "$REPO" \ | ||
| --json comments --jq "[.comments[] | select(.body | contains(\"$sentinel\"))] | length") | ||
| if [[ "$already_posted" -gt 0 ]]; then | ||
| echo " Skipping — conflict for $base_branch@$base_sha already dispatched" | ||
| return 0 | ||
| fi | ||
|
|
||
| echo " Dispatching claude-rebase for $base_branch@$base_sha and posting conflict comment" | ||
|
|
||
| # Dispatch FIRST: if this fails the sentinel comment is never posted, | ||
| # so the next auto-rebase run for this base SHA can retry. | ||
| # repository_dispatch is one of two event types GITHUB_TOKEN IS allowed to | ||
| # trigger new workflow runs for (the other being workflow_dispatch). | ||
| gh api "repos/$REPO/dispatches" \ | ||
| -X POST \ | ||
|
Comment on lines
+67
to
+68
There was a problem hiding this comment.
If the Useful? React with 👍 / 👎. |
||
| -f event_type=claude-rebase \ | ||
| -F "client_payload[pr_number]=$pr_number" \ | ||
| -F "client_payload[head_ref]=$head_ref" \ | ||
| -F "client_payload[base_branch]=$base_branch" | ||
|
Comment on lines
+67
to
+72
There was a problem hiding this comment.
For downstream repos that pick up the updated Useful? React with 👍 / 👎. |
||
|
|
||
| # Post sentinel only after successful dispatch so the idempotency guard | ||
| # never permanently blocks retries when a prior dispatch failed. | ||
| local body="$sentinel" | ||
| body+=$'\n'"**Auto-rebase failed — merge conflict** — this branch conflicts" | ||
| body+=" with \`$base_branch\` and cannot be updated via the merge strategy." | ||
| body+=$'\n\n'"Claude has been dispatched to attempt an agentic rebase with conflict resolution." | ||
| body+=" If Claude's rebase also fails, resolve manually:" | ||
| body+=$'\n'"\`\`\`"$'\n'"git fetch origin" | ||
| body+=$'\n'"git rebase origin/$base_branch" | ||
| body+=$'\n'"# resolve conflicts per file, then for each commit:" | ||
| body+=$'\n'"git add <resolved-files>"$'\n'"git rebase --continue"$'\n'"git push --force-with-lease"$'\n'"\`\`\`" | ||
| gh pr comment "$pr_number" --repo "$REPO" --body "$body" | ||
|
don-petry marked this conversation as resolved.
|
||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When a downstream repo invokes
auto-rebase-reusable.yml@v1, this checkout does not specifyref, so the helper script is loaded frompetry-projects/.github’s default branch rather than the same version as the reusable. I checkedactions/checkout’s README: for a different repository, omittedref“uses the default branch.” That bypasses the standards guarantee that@v1insulates adopters from changes on main, so any future incompatible edit toscripts/auto-rebase.shcan break all pinned callers immediately; checkout the same tag/SHA as the reusable or vendor the script within the versioned workflow.Useful? React with 👍 / 👎.