Run eligible PR checks and maintain automated proposal branches

Merged
UN
5d ago
+1017-43

Automation PRs published with GITHUB_TOKEN can leave native PR checks awaiting maintainer approval. Sync and closeout now offer optional App publication for unattended eligible checks and maintain proposal freshness through an expected-head branch-update lease.

Callers have two documented paths in automated proposal landing:

  • Without an App: leave App inputs empty, approve the exact-head native PR runs, wait for required checks and conversations, then merge using an authorized maintainer credential. The fallback dispatches additional validation but does not arm auto-merge. New heads may need approval again.
  • With an App: map PM_GITHUB_APP_CLIENT_ID to automation-app-client-id and PM_GITHUB_APP_PRIVATE_KEY to automation_app_private_key. The pinned official token action mints a caller-scoped token after local gates. Publication and branch refresh start native PR checks, while expected-head squash auto-merge remains subject to GitHub protections. Partial credentials fail before publication.

Native PR triggers and accurate required contexts remain necessary. Optional dispatched head validation defaults to existing dispatchable ci.yml codeql.yml, respecting explicit overrides; dispatched checks do not satisfy PR required-check rules. Closeout requires an accurate required-checks declaration when protection metadata cannot be read. App monitoring ends within forty minutes of token creation; fallback monitoring is bounded to two hours. Daily release authentication is outside this change.

The workflow regressions cover common dispatch trigger forms, App-only auto-merge, leased branch refresh and redispatch, bounded retries for transient PR/ancestry reads, and fail-closed malformed ancestry. Earlier behavioral revert proofs failed all 16 trigger acceptance cases, both fallback guard cases, all four PR poll cases and all four ancestry poll cases when only their respective fixes were reverted.

The current README review finding is fixed in 9fdc0fc583c02dba9a25bd9c1f362678f75e4760: the parity table and both initial/repeated auto-merge instructions explicitly require App mode. The no-App path states the maintainer approval and authorized merge steps. Before this correction the README could leave a maintainer waiting for an auto-merge that the workflow never armed. The guidance agrees with GitHub's token approval documentation.

node --test --test-name-pattern="README distinguishes" test/bot-pr-workflow.test.ts passes 1/1. Keeping the new regression and reverting only README.md to d9c5ef4 fails 1/1; restoring the README fix passes. All five tracker-linked commands pass: maintenance 54/54, workflow integration 3/3, workflow versions 43/43, poll regressions 10/10, and README contract 1/1.

Both exact commands pass on source 9fdc0fc583c02dba9a25bd9c1f362678f75e4760, checked out explicitly on hosted runners with a fresh HOME and global/system Git identity disabled:

Both have zero failures, cancellations, skips or todos and exact 100% lines/statements/branches/functions across all 14 authored modules. Type checking, build, docstrings, lint, duplication, privacy, production audit, package dry run, changelog and publish-attestation checks pass at unchanged thresholds. The incomplete local full run was stopped under measured shared-host contention and is not counted as a passing receipt. The temporary validator stays outside this PR's source.

Final head 1a0fb90ff6468376789e3151a02494f715584914 adds only tracker receipts and releases the claim; production source, tests, workflows, scripts, documentation and pins are identical to the validated source. Changelog regeneration/check and the final privacy audit pass (5,327 objects). Strict health, including merge drivers, passes on the final head from a fresh git clone --no-local with CI identity isolation; only advisory telemetry queue and stale-item warnings remain. Final-head Node 22/26 CI, including native Bun acceptance, and CodeQL pass; Semgrep passes as well. CodeRabbit has no unresolved thread on this head. Skipped or neutral reviewer checks remain missing approval evidence.

PM: pm-github-8r7c. Caller adoption remains separately tracked in pm-github-aiok. No open GitHub issue names this PR. The claim is released with the item left in progress. No thread was manually resolved; this work performs no merge or release.