fix(fleet-bump): log every per-app decision, not just the step summary - #536
Merged
Conversation
The per-app verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the ECHO SOURCE and never the decision. The one question you ask a weekly sweep -- what did it decide for each app? -- was unanswerable from the log. Concretely, on 2026-08-21 establishing that a docudesk skip was the open-PR guard and not "already current" required cross-checking the ABSENCE of a ::notice:: annotation against the version in a remote lockfile. That is not a diagnosis anyone should have to reconstruct, and it is exactly the shape of evidence that goes wrong quietly. Routes all six decision sites through a row() helper that writes the markdown row to the summary AND a `DECISION: ...` line to stdout. Row rendering is unchanged.
This was referenced Aug 21, 2026
rubenvdlinde
added a commit
that referenced
this pull request
Aug 21, 2026
* fix(friday-merge): log every per-PR verdict, not just the step summary This workflow MERGES pull requests unattended. Its per-PR verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the echo source and never which PRs were merged, nor why the others were not. MEASURED 2026-08-21: a dry run reported "39 merged/would-merge, 44 skipped" and the log could not name a single one of those 83 PRs. For an automation that merges dozens of PRs without a human present, the audit trail then exists only as one rendered artifact, unreadable to any script and easy to lose. All eight verdict sites now route through srow(), which writes the markdown row to the summary AND a `VERDICT: ...` line to stdout. Table headers are deliberately not logged. Verified the emitted markdown is byte-identical. * fix(fleet): log verdicts in the CVE release and drift sweep too Completes the same fix applied to fleet-shared-dep-bump (#536) and fleet-friday-merge (#537): per-app verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the echo source and never a decision. fleet-cve-release merges and SHIPS security fixes across the beta and main protections unattended. Its entire safety rests on one judgement -- is this PR a security fix? -- so the record of how each PR was classified IS the record of whether the workflow behaved correctly. That record should not exist solely as a rendered artifact. fleet-drift-sweep exists to answer "which apps are red under today's gates". An answer no script can read is most of the way to no answer. --------- Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per-app verdicts went only to
$GITHUB_STEP_SUMMARY, sogh run view --logshowed the echo source and never the decision. The one question you ask a weekly sweep — what did it decide for each app? — was unanswerable from the log.On 2026-08-21, establishing that a docudesk skip was the open-PR guard and not
already currentrequired cross-checking the absence of a::notice::annotation against the version in a remote lockfile. Nobody should have to reconstruct that, and it's exactly the shape of evidence that goes wrong quietly.All six decision sites now route through a
row()helper that writes the markdown row to the summary and aDECISION: …line to stdout. Row rendering is unchanged — verified the emitted markdown is byte-identical in shape.Third and last of the defects found while verifying
FLEET_DISPATCH_TOKENend-to-end (after #534 npm version, #535 open-PR guard).