Repository navigation
fix(release-pr-checks): allow bounded post-approval rollup visibility delay #71
Description
Observed failure
The shared release_pr_checks.py treats an empty PR check rollup immediately after approval as proof that approval did not work. The observed run disproves that assumption.
In Logismos run 33994213613, the helper approved three held runs for release PR #152 at 2026-09-05T21:51:02.391Z, then queried the rollup about 249 ms later (21:51:02.641Z) and failed with zero contexts. Its diagnostic asserts this is not transient.
Individual checks became visible at 21:51:04–06. A subsequent read showed 11 check runs. The approved Gate Attestation run 33994212723 and Security run 33994212836 completed successfully. GPU-denied run 33994212236 reached real checks and has its own failing check; that is distinct from an empty rollup or failed approval.
The caller permission cap was already repaired in Logismos #153. This run started, passed the helper's self-tests, and successfully approved runs. Further permission broadening is not supported by this evidence.
Desired correction
Boundedly poll for check-rollup materialization after approval/dispatch, distinguishing pending visibility from a terminal empty result. Do not wait for checks to turn green and do not report success on timeout. Use deterministic delayed-visibility tests plus permanent-empty and API-error cases; retain the fail-loud behavior for a genuine bounded failure. Remove the unsupported assertion that an immediate empty read cannot be transient.
No shared-reusable code or credentials were changed during this investigation. Source path: scripts/release_pr_checks.py in the reusable revision reached through release-pr-checks.yml at 5556cb9.
Activity
forkwright commentedon Sep 9, 2026
New occurrence after Logismos PR #187: https://github.com/forkwright/logismos/actions/runs/34332893837 (job 102405396573), shared helper revision 5556cb9. At 2026-09-09 09:07:16 UTC it reported release PR #152 head 0b0e10ced7fa9d9e4a40566946f9281ffdb46678 had NO rollup checks immediately after approving 3 held runs (0 dispatched), then failed. A subsequent read of that SAME head showed 10 rollup checks. This supports the visibility-delay issue; the empty immediate rollup is not proof that approval authority is absent. One later release-branch boundary check is separately failed and must not be conflated with the empty-rollup observation. Logismos #187 candidate gate, boundary/HIP and security passed and merged-tree equality was verified. No shared workflow, token, service or release-merge changes made.
forkwright commentedon Sep 9, 2026
Another observed instance after Logismos #188: run 34340307593 approved three runs for release PR #152 at
1dc74c1cdcd8b27dcbd0b3c893284d3144655189at 10:27:37 UTC, then failed at 10:27:38 on an empty rollup. A subsequent read of the same unchanged head showed eleven check entries, including the passed gate. This supports the existing post-approval visibility race; the helper's immediate empty-rollup result is not evidence that token approval failed. No helper, workflow, token or release-branch change was made.