Skip to content

ci(kai-ci): make the pin job re-runnable #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fatihacet merged 1 commit into from
Sep 8, 2026
Merged

ci(kai-ci): make the pin job re-runnable #93

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion .github/workflows/build-kai-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -271,6 +271,7 @@ jobs:
token: ${{ steps.token.outputs.token }}

- name: Bump the pinned digest
id: bump
env:
DIGEST: ${{ needs.build.outputs.digest }}
PROVENANCE: ${{ needs.build.outputs.provenance }}
Expand All @@ -280,6 +281,23 @@ jobs:
set -euo pipefail
NEW="${IMAGE}@${DIGEST}"
BR="kai-ci/pin-${DIGEST:7:12}"
echo "branch=$BR" >> "$GITHUB_OUTPUT"

@kaicontext kaicontext Bot Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

id: bump and the branch=$BR output are never read anywhere, and the branch name is recomputed independently in the PR step, so the two can silently drift.


# RE-RUNNABLE. The branch name is derived from the digest, so a re-run
# of the same build computes the same name — and the first attempt may
# already have pushed it and then failed later (which is exactly how
# this was found: attempt 1 pushed the branch and died opening the PR,
# attempt 2 rebuilt an identical commit and was rejected non-fast-
# forward). Same digest means the same edit, so an existing branch is
# already the right branch: reuse it and move on to the PR.
#
# Not a force-push. Overwriting a branch someone may have reviewed, to
# replace it with identical content, is all cost and no benefit.
if git ls-remote --exit-code --heads origin "$BR" >/dev/null 2>&1; then

@kaicontext kaicontext Bot Sep 8, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the reuse early-exit trusts the pre-existing remote branch's content without re-deriving it, so a same-digest re-run after main moved would ship a branch built on the stale base (mitigated by human PR review, not a corruption).

echo "$BR already exists — an earlier attempt pushed it; reusing"
exit 0
fi
Comment on lines +296 to +299

@greptile-apps greptile-apps Bot Sep 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Digest-only reuse drops pin changes

When a later dispatch produces the same digest with a different pin selection, this branch-existence check skips the new edit and then reuses the existing PR, causing requested targets such as defaultReviewImage to remain stale.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/build-kai-ci.yml
Line: 296-299

Comment:
**Digest-only reuse drops pin changes**

When a later dispatch produces the same digest with a different `pin` selection, this branch-existence check skips the new edit and then reuses the existing PR, causing requested targets such as `defaultReviewImage` to remain stale.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Fix in Claude Code Fix in Codex


git config user.name "kai-ci"
git config user.email "noreply@kaicontext.com"
git checkout -b "$BR"
Expand Down Expand Up @@ -322,8 +340,19 @@ jobs:
PIN: ${{ inputs.pin }}
run: |
set -euo pipefail
BR="kai-ci/pin-${DIGEST:7:12}"

# Same idempotency question, other end: a re-run whose branch already
# carries a PR must not fail trying to open a second one.
EXISTING="$(gh pr list --repo kaicontext/kai-server --head "$BR" \
--state open --json number --jq '.[0].number // empty')"
if [ -n "$EXISTING" ]; then
echo "PR #$EXISTING already open for $BR — nothing to do"
exit 0
fi

gh pr create --repo kaicontext/kai-server \
--head "kai-ci/pin-${DIGEST:7:12}" --base main \
--head "$BR" --base main \
--title "build(kai-ci): pin the $PIN image to ${DIGEST:7:12}" \
--body "$(cat <<EOF
A new \`kai-ci\` image, built from known refs by [run ${{ github.run_number }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
Expand Down