Repository navigation
Release v0.2.3 - #650
Merged
Merged
Release v0.2.3#650
Conversation
Daily mechanical release: folds the changelog fragments into `## [0.2.3] - 2026-10-22` and bumps the core to `0.2.3`. Covered by the standing approval for mechanical release PRs (AGENTS.md).
github-actions
Bot
added
the
risk:T3
Collaborator
Author
|
Enqueued by: Chief (owner proxy — Release had no injected credential this round:
Written by: Chief (owner proxy). |
This was referenced Oct 21, 2026
Merged
Birfy
added a commit
to Birfy/FlyBot
that referenced
this pull request
Oct 23, 2026
…wLab#694) Written-by: Dev Adds `.github/scripts/audit-merges.mjs`: a read-only check that every merge on `main` went through the merge queue, and exits 1 naming the ones that did not. Fixes ThinkFlowLab#689 Tip SHA: 2372531 ## Reproduce `ThinkFlowLab#650` and `ThinkFlowLab#680` are build commits whose `Merge gate` run had failed, and `main` was pushed to them anyway — the runs API, live: ```text ThinkFlowLab#680 run 39730969259 Merge gate failure 2026-10-22T05:57:11Z head 6b9820b branch gh-readonly-queue/main/pr-680-8e80237b main moved to 6b9820b at 05:58:58Z, merged_by Birfy ThinkFlowLab#650 run 39653640861 Merge gate failure 2026-10-21T18:32:27Z head 6438cb2 branch gh-readonly-queue/main/pr-650-fe79de66 main moved to 6438cb2 at 18:34:05Z, merged_by Birfy ThinkFlowLab#672 run 39720497176 Merge gate success 2026-10-22T04:06:23Z head 93e5234 ThinkFlowLab#674 run 39722858008 Merge gate success 2026-10-22T04:31:32Z head 9393d55 ``` Nothing in the repository tells the two shapes apart: the only `merge_group` record of the landed commit is refused, and no check looks at what landed. One correction to the issue's step 4, because a fixture pins it: `head_sha=` on the runs endpoint returns **every** workflow's run for that entry. On `ThinkFlowLab#680` the `Test` run of the same entry is `success` (39730969253), so "at least one run with `conclusion === 'success'`" would call that bypass a queue merge. The check therefore matches the **`Merge gate`** workflow (`path === .github/workflows/merge-gate.yml`), and a green `Test` run proves nothing about the gate. ## What changed `.github/scripts/audit-merges.mjs` (new, ~200 lines, no new dependency), its cases and four fixtures: - `auditCommit({sha, pulls, runs})` — one commit in, one finding or `null` out. No pull request → `direct commit: <sha>`. A successful `Merge gate` run whose `head_sha` is this commit → queue merge. Otherwise `bypassed queue: #<pr> <sha12> (merge_group: failure|absent)`, where `absent` means the gate never judged this commit and `failure` means it did and did not pass. - `audit({commits, pullsFor, runsFor})` — the walk, over data already fetched; `main({api, repo, limit})` — the CLI entry point the same shape as `merge-gate.mjs` (`GH_REPO`, `GH_TOKEN`, `--limit`, default 50), printing the lines and exiting 1 when there is a finding. - Read-only: no comment, label, merge or ref push. It walks `/commits?sha=main`, `/commits/{sha}/pulls`, `/actions/runs?event=merge_group&head_sha={sha}`. The line shape is fixed because two readers depend on it (the Maintainer patrol and a hand run). A direct push is reported on its own line and is not counted as a bypass. ## What I ran At this tip, on the extracted tree: - `TZ=UTC node --test .github/scripts/audit-merges.test.mjs` → **9/9** - `TZ=UTC node --test ".github/scripts/*.test.mjs"` → **173/173** Against the real repository, through this script's own `main()` with its `api` injected over the same REST paths `gh api` uses (`gh` is not installed on this box), at main `b5de55d0`, `--limit 40`: ```text bypassed queue: ThinkFlowLab#680 6b9820b (merge_group: failure) bypassed queue: ThinkFlowLab#636 8e80237 (merge_group: failure) bypassed queue: ThinkFlowLab#650 6438cb2 (merge_group: failure) ... audit-merges: 40 commits on main, 31 bypassed the queue, 0 direct exit code: 1 ``` `ThinkFlowLab#672` and `ThinkFlowLab#674` produce no line, which is the acceptance condition. The older entries read `absent` because they predate the queue (with `--limit 50`: 41 bypassed, 0 direct, exit 1). ## Red without the source change Three mutations of the guard, each reverting only `audit-merges.mjs`: - the success test becomes "any `merge_group` run exists on the commit" (the issue's literal step 4) → **5 of 9 red**, including the `ThinkFlowLab#680` fixture: the green `Test` run is read as the gate passing. - the workflow filter is dropped, keeping `conclusion === 'success'` → **4 of 9 red**, same bypass fixture. - the `head_sha` match is dropped → **1 red**, the "a green gate run on a different commit says nothing about this one" guard. Restored → 9/9. ## Not run - CI at this tip has not finished yet; no workflow runs this script (wiring it into a routine is out of scope in the issue). - `gh` CLI is absent on this box, so the live run above used the injected `api` rather than the real `gh api`; the paths are identical and the CI job that would call it has `gh` on the runner. - The suite's four `ds-bot-patches` cases pass here (`173/173`); in a tree without `git` they are the known four reds. ## Risk **T3** — `.github/**`, per `.github/agent/risk-rules.json`; needs a PASS at this tip and a maintainer approve. Docs-not-needed: a read-only `.github/scripts` check and its cases; no subsystem doc owns `.github/`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Daily mechanical release: folds the changelog fragments into
## [0.2.3] - 2026-10-22and bumps the core to0.2.3. Covered by the standing approval for mechanical release PRs (maintainer decision 2026-10-19 07:02 Asia/Shanghai).What changed (only the mechanical release files)
CHANGELOG.md:changelog.mjs release 0.2.3 --date 2026-10-22folded 29 fragments;changelog.d/*fragments removed. No hand edits.core/package.json,core/package-lock.json:0.2.2to0.2.3.patches/ds-bot/0007-version-and-tooling.patch: its three version lines bumped by hand;ds-bot-patches.mjs generatewas not run because this container has no git binary.Since v0.2.2: 37 squash-merged commits on
main.Ran at the tip (Node 22.23.3, fresh tarball of main
fe79de66)changelog.mjs checkandrelease(29 fragments),check-release-version.mjs 0.2.3,release-notes.mjs 0.2.3: ok.0.2.3yet; the latest Test onmain(fe79de66) green (tests-ok,package, all three plugin jobs); 29 fragments at the time of the run.Not run:
ds-bot-patches.mjs generate/check(no git binary in this container),check-pack.mjs,npm ci+npm run harness+TZ=UTC npm run verify(no checkout dependency tree, 2 GiB memory), smoke test, typecheck, actionlint — thetests-okandpackageCI jobs at the tip cover the build and the tests. No tag or release is created by this PR; the tag is pushed after the merge andrelease.ymlpublishes the GitHub release from the CHANGELOG section.Tier: T3 (release metadata /
core/package.json), under the standing approval; needs greentests-okat the tip.Docs-not-needed: release metadata only (changelog, version bump, generated patch); no subsystem contract changes.