fix(friday-merge): log every per-PR verdict, not just the step summary - #537
Merged
Conversation
This workflow MERGES pull requests unattended. Its per-PR verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the echo source and never which PRs were merged, nor why the others were not. MEASURED 2026-08-21: a dry run reported "39 merged/would-merge, 44 skipped" and the log could not name a single one of those 83 PRs. For an automation that merges dozens of PRs without a human present, the audit trail then exists only as one rendered artifact, unreadable to any script and easy to lose. All eight verdict sites now route through srow(), which writes the markdown row to the summary AND a `VERDICT: ...` line to stdout. Table headers are deliberately not logged. Verified the emitted markdown is byte-identical.
rubenvdlinde
added a commit
that referenced
this pull request
Aug 21, 2026
* fix(friday-merge): log every per-PR verdict, not just the step summary This workflow MERGES pull requests unattended. Its per-PR verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the echo source and never which PRs were merged, nor why the others were not. MEASURED 2026-08-21: a dry run reported "39 merged/would-merge, 44 skipped" and the log could not name a single one of those 83 PRs. For an automation that merges dozens of PRs without a human present, the audit trail then exists only as one rendered artifact, unreadable to any script and easy to lose. All eight verdict sites now route through srow(), which writes the markdown row to the summary AND a `VERDICT: ...` line to stdout. Table headers are deliberately not logged. Verified the emitted markdown is byte-identical. * fix(fleet): log verdicts in the CVE release and drift sweep too Completes the same fix applied to fleet-shared-dep-bump (#536) and fleet-friday-merge (#537): per-app verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the echo source and never a decision. fleet-cve-release merges and SHIPS security fixes across the beta and main protections unattended. Its entire safety rests on one judgement -- is this PR a security fix? -- so the record of how each PR was classified IS the record of whether the workflow behaved correctly. That record should not exist solely as a rendered artifact. fleet-drift-sweep exists to answer "which apps are red under today's gates". An answer no script can read is most of the way to no answer. --------- Co-authored-by: Conduction Release Bot <release-bot@conduction.nl>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This workflow merges pull requests unattended. Its per-PR verdicts went only to
$GITHUB_STEP_SUMMARY, sogh run view --logshowed the echo source and never which PRs were merged, nor why the others weren't.Measured 2026-08-21: a dry run reported
39 merged/would-merge, 44 skipped— and the log could not name a single one of those 83 PRs.For an automation that merges dozens of PRs with no human present, that leaves the audit trail as one rendered artifact: unreadable to any script, and easy to lose.
All eight verdict sites now route through
srow(), writing the markdown row to the summary and aVERDICT: …line to stdout. Table headers are deliberately not logged. Emitted markdown verified byte-identical.Same gap exists in
fleet-cve-release.yml(9 sites) andfleet-drift-sweep.yml(6) — following separately. Companion to #536, which fixed it infleet-shared-dep-bump.yml.