fix(fleet): log verdicts in the CVE release and drift sweep too - #538
Merged
Conversation
added 2 commits
August 21, 2026 12:41
This workflow MERGES pull requests unattended. Its per-PR verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the echo source and never which PRs were merged, nor why the others were not. MEASURED 2026-08-21: a dry run reported "39 merged/would-merge, 44 skipped" and the log could not name a single one of those 83 PRs. For an automation that merges dozens of PRs without a human present, the audit trail then exists only as one rendered artifact, unreadable to any script and easy to lose. All eight verdict sites now route through srow(), which writes the markdown row to the summary AND a `VERDICT: ...` line to stdout. Table headers are deliberately not logged. Verified the emitted markdown is byte-identical.
Completes the same fix applied to fleet-shared-dep-bump (#536) and fleet-friday-merge (#537): per-app verdicts went only to $GITHUB_STEP_SUMMARY, so `gh run view --log` showed the echo source and never a decision. fleet-cve-release merges and SHIPS security fixes across the beta and main protections unattended. Its entire safety rests on one judgement -- is this PR a security fix? -- so the record of how each PR was classified IS the record of whether the workflow behaved correctly. That record should not exist solely as a rendered artifact. fleet-drift-sweep exists to answer "which apps are red under today's gates". An answer no script can read is most of the way to no answer.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Completes the fix applied in #536 (
fleet-shared-dep-bump) and #537 (fleet-friday-merge): per-app verdicts went only to$GITHUB_STEP_SUMMARY, sogh run view --logshowed the echo source and never a decision.fleet-cve-releasemerges and ships security fixes across the beta and main protections unattended. Its entire safety rests on one judgement — is this PR a security fix? — so the record of how each PR was classified is the record of whether the workflow behaved. That shouldn't live solely as a rendered artifact. (9 sites →srow().)fleet-drift-sweepexists to answer "which apps are red under today's gates". An answer no script can read is most of the way to no answer. (Adds aVERDICT:line per app, carrying the raw conclusion and run URL.)Markdown rendering unchanged in both; validated with
bash -non every extractedrun:block.