From 49de035ca2957193eacb4b9f0c941e700c51c22a Mon Sep 17 00:00:00 2001 From: WOLIKIMCHENG Date: Wed, 16 Sep 2026 15:52:01 +0800 Subject: [PATCH] fix(workflows): exempt catalog automation from PR-count confirmation Clarify that repository-owned community extension, preset, and bundle workflows bypass the ordinary contributor confirmation gate only after successful validation and allowed catalog/docs updates. Add regression coverage for the runtime-imported instruction, draft PR configuration, and catalog-specific allowed files. Fixes #4597 --- .github/workflows/add-community-bundle.md | 5 +++ .github/workflows/add-community-extension.md | 5 +++ .github/workflows/add-community-preset.md | 5 +++ tests/test_github_workflows.py | 42 ++++++++++++++++++++ 4 files changed, 57 insertions(+) diff --git a/.github/workflows/add-community-bundle.md b/.github/workflows/add-community-bundle.md index 1f6d68c605..4ef48ed57f 100644 --- a/.github/workflows/add-community-bundle.md +++ b/.github/workflows/add-community-bundle.md @@ -276,6 +276,11 @@ repository README remains the source for the actual URLs. Create one draft pull request. +This repository-owned gh-aw maintenance workflow does not perform the contributor +open-PR count check or request confirmation. After successful validation and +allowed catalog/docs file updates, emit the configured draft `create_pull_request` +safe output regardless of the submitter's or filing account's open PR count. + - New entry branch: `community/${{ github.event.issue.number }}-add--bundle` - Update branch: diff --git a/.github/workflows/add-community-extension.md b/.github/workflows/add-community-extension.md index c59f20ddac..eb09c66475 100644 --- a/.github/workflows/add-community-extension.md +++ b/.github/workflows/add-community-extension.md @@ -257,6 +257,11 @@ Find the existing row and update any changed fields in-place. Create a pull request with the changes. Use this branch naming convention: +This repository-owned gh-aw maintenance workflow does not perform the contributor +open-PR count check or request confirmation. After successful validation and +allowed catalog/docs file updates, emit the configured draft `create_pull_request` +safe output regardless of the submitter's or filing account's open PR count. + - **New extension:** `add--extension` - **Update:** `update--extension` diff --git a/.github/workflows/add-community-preset.md b/.github/workflows/add-community-preset.md index f93dbef0f6..2bcc3f518c 100644 --- a/.github/workflows/add-community-preset.md +++ b/.github/workflows/add-community-preset.md @@ -310,6 +310,11 @@ Find the existing row and update any changed fields in-place. Create a pull request with the changes. Use this branch naming convention: +This repository-owned gh-aw maintenance workflow does not perform the contributor +open-PR count check or request confirmation. After successful validation and +allowed catalog/docs file updates, emit the configured draft `create_pull_request` +safe output regardless of the submitter's or filing account's open PR count. + - **New preset:** `add--preset` - **Update:** `update--preset` diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py index 727bb08e63..9092b63506 100644 --- a/tests/test_github_workflows.py +++ b/tests/test_github_workflows.py @@ -55,6 +55,12 @@ "Do not modify any other files", ), ) +REPOSITORY_OWNED_DRAFT_PR_EXEMPTION = ( + "This repository-owned gh-aw maintenance workflow does not perform the contributor " + "open-PR count check or request confirmation. After successful validation and " + "allowed catalog/docs file updates, emit the configured draft `create_pull_request` " + "safe output regardless of the submitter's or filing account's open PR count." +) def _publish_workflow_steps() -> dict[str, dict[str, object]]: @@ -105,6 +111,19 @@ def _create_pull_request_allowed_files(source_text: str) -> list[str]: ] +def _compiled_create_pull_request_config(compiled_text: str) -> dict[str, object]: + compiled = yaml.safe_load(compiled_text) + config_step = _workflow_step( + compiled["jobs"]["agent"]["steps"], "Generate Safe Outputs Config" + ) + config = next( + line.strip() + for line in config_step["run"].splitlines() + if line.lstrip().startswith('{"') + ) + return json.loads(config)["create_pull_request"] + + def _workflow_frontmatter(source_text: str) -> dict[str, object]: _, frontmatter, _ = source_text.split("---", maxsplit=2) return yaml.safe_load(frontmatter) @@ -319,6 +338,29 @@ def test_community_submission_automation_is_wired_to_allowed_files(): assert label in assignment_text +def test_community_submission_draft_pr_exemption_is_runtime_wired(): + """Repository-owned catalog maintenance bypasses contributor PR-count policy.""" + for workflow, _, catalog_file, docs_file, _ in COMMUNITY_SUBMISSION_WORKFLOWS: + source = WORKFLOWS_DIR / f"add-community-{workflow}.md" + compiled = WORKFLOWS_DIR / f"add-community-{workflow}.lock.yml" + source_text = source.read_text(encoding="utf-8") + compiled_text = compiled.read_text(encoding="utf-8") + + assert REPOSITORY_OWNED_DRAFT_PR_EXEMPTION in " ".join(source_text.split()) + assert ( + f"{{{{#runtime-import .github/workflows/add-community-{workflow}.md}}}}" + in compiled_text + ) + + source_create_pr = _frontmatter(source_text)["safe-outputs"][ + "create-pull-request" + ] + compiled_create_pr = _compiled_create_pull_request_config(compiled_text) + assert source_create_pr["draft"] is True + assert compiled_create_pr["draft"] is True + assert compiled_create_pr["allowed_files"] == [catalog_file, docs_file] + + # Full clauses from the catalog download-URL checks (issue #4185). Assert the # complete sentences so independent keywords cannot drift apart. _CATALOG_DOWNLOAD_URL_CLAUSES = (