fix(agent-ingress): pin ci-failure-analyst to v1-stable; fix the analyst loop guard

Merged
DO
7d ago
+24-4

What

Two defects in the ci-failure-analyst job of .github/workflows/agent-ingress.yml. Both were carried over unchanged from the pre-collapse stub when markets#513 collapsed the roles:

  1. Bare-SHA pin to channel. @b58510275dd1… # DEFECTIVE PIN becomes @ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref, matching how the other four roles pin their channels (petry-projects/.github-private#2176).
    • The reusable at ci-failure-analyst/v1-stable (cc0bc61) has the same interface: the single required secret CLAUDE_CODE_OAUTH_TOKEN and job analyze.
    • It runs the same steps and loads no external prompts or scripts.
    • Its only difference from b585102 is a workflow-level permissions: block, which this job already grants.
  2. Loop guard. !startsWith(check_run.name, 'CI Failure Analyst') becomes 'ci-failure-analyst'. The analyst's own check run is named ci-failure-analyst / analyze, so the old guard never matched, and a failed analyst run would re-trigger the analyst (petry-projects/.github-private#2175).

Checks

  • scripts/validate-ingress-if.sh (from .github-private): OK.
  • scripts/validate-caller-inputs.sh: OK. ci-failure-analyst@v1-stable resolves and its concurrency group does not collide with the reusable's.
  • .github/scripts/tests/agent-ingress-workflow.bats: the two assertions that encoded the old values are updated. Two tests are added: one checks the guard prefix matches the real check name, and one checks the pin is the channel and carries no DEFECTIVE PIN marker.
  • Job-block SHAs: dev-lead, pr-auto-review, pr-review and pr-review-mention are unchanged. ci-failure-analyst is now 4368213cf1825f4ff9c936b2a9340e95805a1acf. The canonical template in petry-projects/.github#1316 gets the identical block in the same window, so the Fleet Monitor classifies all five roles ALIGNED.

Refs petry-projects/.github-private#1729, petry-projects/.github-private#2176, petry-projects/.github-private#2175

🤖 Generated with Claude Code

https://claude.ai/code/session_01Muchy4bnEhyVEnd89TUtjj

Generated by Claude Code

Problem

See the linked issue.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

Tests added/updated: .github/scripts/tests/agent-ingress-workflow.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.

Summary by CodeRabbit

  • Chores
    • Updated the CI failure analyst workflow to use its stable release channel and consistently recognize its check-run names.
    • Added checks to verify the workflow’s channel and check-run matching.