train-push.sh now waits for every branch-protection-required status check before pushing the train sha to the default branch, instead of only watching the CI workflow run it launched.
It reads the required contexts from the protection API and polls the check runs and commit statuses endpoints until all contexts report success, naming failed, pending, or missing contexts in the landing failure message. Duplicate results for the same context are resolved by newest timestamp, empty conclusions stay distinct from success, and failure messages keep linking the green CI run. If the protection API is unreadable, it falls back to the existing CI-only landing behavior.
Confidence Score: 5/5
The latest changes appear safe to merge.
Summary
train-push.sh now waits for branch-protection-required checks before either landing path pushes to the default branch. Unreadable protection settings retain the existing CI-only fallback.
Train landing checks every reported required status before pushing.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[CI succeeds] --> B[Read required checks]
B -->|Unreadable or empty| F[Existing landing path]
B -->|Requirements found| C[Read results for train SHA]
C -->|All successful| F
C -->|Pending or missing| D[Wait within poll limit]
D --> C
C -->|Failed or query error| E[Stop with CI link]
D -->|Limit reached| E
