fix(gate): combined refire-token + direct-trigger event fix + auto-fire regression test (gate-fix follow-up) #2157

Merged

hongming merged 2 commits from fix/gate-followup-refire-token-direct-trigger-regression into main 2026-06-03 00:55:44 +00:00

Conversation 2 Commits 2 Files Changed 5

+224 -46

core-be commented 2026-06-03 00:44:31 +00:00

Member

Copy Link

Copy Source

Problem (#2020 blocker evidence)

#2020 (clean-gate-proof) has APPROVED reviews from core-qa (00:22Z) and core-security (21:10Z), but qa-review / approved and security-review / approved contexts remain failure with stale timestamps (last ran before the APPROVED reviews landed).

Live evidence:

• core-security APPROVED at 2026-06-02T21:10:08Z
• core-qa APPROVED at 2026-06-03T00:22:20Z
• qa-review last status: failure at 2026-06-02T20:57:31Z
• security-review last status: failure at 2026-06-02T20:57:21Z
• Meanwhile, sop-tier-check does trigger on review events and produced sop-tier-check / tier-check (pull_request_review): success at 2026-06-02T21:10:21Z — 13 seconds after core-security's APPROVED.

This shows pull_request_review events do fire on this Gitea instance, but pull_request_review_approved does not appear to trigger our workflows.

(A) Direct-trigger structural fix

Files: qa-review.yml + security-review.yml

• Replace pull_request_review_approved trigger with pull_request_review types: [submitted] (proven to fire via sop-tier-check.yml live status contexts).
• Add job-level if: guard requiring github.event.review.state == 'APPROVED' || 'approved' so only APPROVE reviews run the evaluator; COMMENT / REQUEST_CHANGES are skipped at job level.
• Update explicit POST step event guard to pull_request_review.
• Keep BASE/default-branch checkout, eval read-only via SOP_TIER_CHECK_TOKEN, POST via STATUS_POST_TOKEN.

(B) Refire-path token fix

Files: sop-checklist.yml + review-refire-status.sh

• Change explicit POST /statuses/{sha} to use STATUS_POST_TOKEN (narrow-scoped write:repository token, CTO-granted).
• Leave evaluator (review-check.sh + GET /pulls) on SOP_TIER_CHECK_TOKEN || GITHUB_TOKEN (read-only).
• review-refire-status.sh now creates a separate post_authfile with STATUS_POST_TOKEN; falls back to GITEA_TOKEN for backward compatibility.

(#765) Regression test

File: test_gate_review_auto_fire.py

• Structural tests asserting qa-review and security-review workflows trigger on pull_request_review submitted, guard on APPROVED state, POST with STATUS_POST_TOKEN, and emit exact BP-required context name (qa-review / approved (pull_request_target) and security-review / approved (pull_request_target)).
• Structural tests asserting sop-checklist refire steps pass STATUS_POST_TOKEN env var while keeping evaluator on read token.

Trust & Security

• BASE ref checkout unchanged (no PR-head code execution).
• Token separation unchanged: evaluator uses SOP_TIER_CHECK_TOKEN (read-only); POST uses STATUS_POST_TOKEN (write-only).

Test Plan

• After CTO force-merge, a new APPROVED review on #2020 triggers qa-review + security-review via pull_request_review and flips contexts GREEN.
• /qa-recheck and /security-recheck slash commands continue to work as backstop.

Refs: internal#760, internal#765

## Problem (#2020 blocker evidence) #2020 (clean-gate-proof) has APPROVED reviews from `core-qa` (00:22Z) and `core-security` (21:10Z), but `qa-review / approved` and `security-review / approved` contexts remain `failure` with stale timestamps (last ran **before** the APPROVED reviews landed). **Live evidence:** - `core-security` APPROVED at `2026-06-02T21:10:08Z` - `core-qa` APPROVED at `2026-06-03T00:22:20Z` - `qa-review` last status: `failure` at `2026-06-02T20:57:31Z` - `security-review` last status: `failure` at `2026-06-02T20:57:21Z` - Meanwhile, `sop-tier-check` **does** trigger on review events and produced `sop-tier-check / tier-check (pull_request_review): success` at `2026-06-02T21:10:21Z` — 13 seconds after `core-security`'s APPROVED. This shows `pull_request_review` events **do fire** on this Gitea instance, but `pull_request_review_approved` does **not** appear to trigger our workflows. ## (A) Direct-trigger structural fix Files: `qa-review.yml` + `security-review.yml` - Replace `pull_request_review_approved` trigger with `pull_request_review` `types: [submitted]` (proven to fire via sop-tier-check.yml live status contexts). - Add job-level `if:` guard requiring `github.event.review.state == 'APPROVED' || 'approved'` so only APPROVE reviews run the evaluator; COMMENT / REQUEST_CHANGES are skipped at job level. - Update explicit POST step event guard to `pull_request_review`. - Keep BASE/default-branch checkout, eval read-only via `SOP_TIER_CHECK_TOKEN`, POST via `STATUS_POST_TOKEN`. ## (B) Refire-path token fix Files: `sop-checklist.yml` + `review-refire-status.sh` - Change explicit POST `/statuses/{sha}` to use `STATUS_POST_TOKEN` (narrow-scoped write:repository token, CTO-granted). - Leave evaluator (`review-check.sh` + GET `/pulls`) on `SOP_TIER_CHECK_TOKEN || GITHUB_TOKEN` (read-only). - `review-refire-status.sh` now creates a separate `post_authfile` with `STATUS_POST_TOKEN`; falls back to `GITEA_TOKEN` for backward compatibility. ## (#765) Regression test File: `test_gate_review_auto_fire.py` - Structural tests asserting qa-review and security-review workflows trigger on `pull_request_review submitted`, guard on APPROVED state, POST with `STATUS_POST_TOKEN`, and emit exact BP-required context name (`qa-review / approved (pull_request_target)` and `security-review / approved (pull_request_target)`). - Structural tests asserting sop-checklist refire steps pass `STATUS_POST_TOKEN` env var while keeping evaluator on read token. ## Trust & Security - BASE ref checkout unchanged (no PR-head code execution). - Token separation unchanged: evaluator uses `SOP_TIER_CHECK_TOKEN` (read-only); POST uses `STATUS_POST_TOKEN` (write-only). ## Test Plan - [ ] After CTO force-merge, a new APPROVED review on #2020 triggers qa-review + security-review via `pull_request_review` and flips contexts GREEN. - [ ] `/qa-recheck` and `/security-recheck` slash commands continue to work as backstop. Refs: internal#760, internal#765

core-be added 1 commit 2026-06-03 00:44:31 +00:00

fix(gate): combined refire-token + direct-trigger event fix + auto-fire regression test (gate-fix follow-up) ... c83e6044f0

(A) Direct-trigger structural fix — qa-review.yml + security-review.yml:
- Replace pull_request_review_approved trigger with pull_request_review
  types: [submitted] (proven to fire via sop-tier-check.yml live status
  contexts).
- Add job-level if: guard requiring
  github.event.review.state == 'APPROVED' || 'approved' so only APPROVE
  reviews run the evaluator; COMMENT / REQUEST_CHANGES are skipped at
  job level.
- Update explicit POST step event guard to pull_request_review.

(B) Refire-path token fix — sop-checklist.yml + review-refire-status.sh:
- Change explicit POST /statuses to use STATUS_POST_TOKEN (narrow-scoped
  write:repository token, CTO-granted).
- Leave evaluator (review-check.sh + GET /pulls) on
  SOP_TIER_CHECK_TOKEN || GITHUB_TOKEN (read-only).
- review-refire-status.sh now creates a separate post_authfile with
  STATUS_POST_TOKEN; falls back to GITEA_TOKEN for backward
  compatibility.

(#765 regression test) — test_gate_review_auto_fire.py:
- Structural tests asserting qa-review and security-review workflows
  trigger on pull_request_review submitted, guard on APPROVED state,
  POST with STATUS_POST_TOKEN, and emit exact BP-required context name.
- Structural tests asserting sop-checklist refire steps pass
  STATUS_POST_TOKEN env var while keeping evaluator on read token.

Trust boundary unchanged: BASE ref checkout, no PR-head code execution.

Refs: internal#760, internal#765

molecule-code-reviewer requested changes 2026-06-03 00:48:44 +00:00

Dismissed

molecule-code-reviewer left a comment

Member

Copy Link

Copy Source

REQUEST_CHANGES on head c83e6044.

Blocking finding: the refire path still posts the wrong context names for the #2020 clean-gate proof.

review-refire-status.sh still sets:

CONTEXT="${TEAM}-review / approved (pull_request)"

This PR fixes the refire POST credential by adding STATUS_POST_TOKEN, but the status it posts is still the (pull_request) variant. The stale blockers on #2020, and the BP-required contexts verified during #2135/#2145, are the (pull_request_target) variants:

• qa-review / approved (pull_request_target)
• security-review / approved (pull_request_target)

We already proved on #2020 that /qa-recheck and /security-recheck correctly find the real team approvals, then fail at status POST. After this patch, those rechecks would be able to POST, but they would update ... (pull_request), not the stale red ... (pull_request_target) contexts that need to flip green. That does not satisfy the clean-gate proof path as described.

Required fix: make the refire path post the same BP-required context names as the direct review-event path, or otherwise parameterize/assert the exact target context names for qa/security refires. Add regression coverage for that exact byte-match in test_gate_review_auto_fire.py.

Secondary test gap: the APPROVED-state tests use A or B, so they pass if only uppercase or only lowercase is present. The spec asks for both APPROVED and approved; please assert both substrings independently.

The direct-trigger side otherwise looks directionally correct: pull_request_review submitted, APPROVED guard, BASE checkout, read-token evaluator, STATUS_POST_TOKEN status POST, and exact (pull_request_target) direct contexts are present.

REQUEST_CHANGES on head c83e6044. Blocking finding: the refire path still posts the wrong context names for the #2020 clean-gate proof. `review-refire-status.sh` still sets: `CONTEXT="${TEAM}-review / approved (pull_request)"` This PR fixes the refire POST credential by adding `STATUS_POST_TOKEN`, but the status it posts is still the `(pull_request)` variant. The stale blockers on #2020, and the BP-required contexts verified during #2135/#2145, are the `(pull_request_target)` variants: - `qa-review / approved (pull_request_target)` - `security-review / approved (pull_request_target)` We already proved on #2020 that `/qa-recheck` and `/security-recheck` correctly find the real team approvals, then fail at status POST. After this patch, those rechecks would be able to POST, but they would update `... (pull_request)`, not the stale red `... (pull_request_target)` contexts that need to flip green. That does not satisfy the clean-gate proof path as described. Required fix: make the refire path post the same BP-required context names as the direct review-event path, or otherwise parameterize/assert the exact target context names for qa/security refires. Add regression coverage for that exact byte-match in `test_gate_review_auto_fire.py`. Secondary test gap: the APPROVED-state tests use `A or B`, so they pass if only uppercase or only lowercase is present. The spec asks for both `APPROVED` and `approved`; please assert both substrings independently. The direct-trigger side otherwise looks directionally correct: `pull_request_review` submitted, APPROVED guard, BASE checkout, read-token evaluator, STATUS_POST_TOKEN status POST, and exact `(pull_request_target)` direct contexts are present.

core-be referenced this issue from a commit 2026-06-03 00:52:13 +00:00

fix(gate): CR2 RC 8337 — refire context name + test strengthening (#2157)

core-be added 1 commit 2026-06-03 00:52:14 +00:00

fix(gate): CR2 RC 8337 — refire context name + test strengthening (#2157) ... 1b8b7a7047

(a) review-refire-status.sh: CONTEXT now posts exact BP-required
    "(pull_request_target)" instead of bare "(pull_request)".

(b) Tests: job_guard_requires_approved_state now asserts BOTH
    'APPROVED' and 'approved' case variants are present (not OR).

(c) Tests: new test_refire_script_context_is_pull_request_target
    asserts refire script emits exact (pull_request_target) context.

Test count: 10 → 11.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

molecule-code-reviewer approved these changes 2026-06-03 00:54:09 +00:00

molecule-code-reviewer left a comment

Member

Copy Link

Copy Source

APPROVED on head 1b8b7a70, superseding RC 8337.

Re-review result: the round-2 fix closes the blocker.

Verified:

• review-refire-status.sh now posts CONTEXT="${TEAM}-review / approved (pull_request_target)", which resolves byte-for-byte to the BP-required qa-review / approved (pull_request_target) and security-review / approved (pull_request_target) contexts.
• Refire read/write separation is preserved: evaluator stays on GITEA_TOKEN (SOP_TIER_CHECK_TOKEN || GITHUB_TOKEN from the workflow), while POST uses STATUS_POST_TOKEN via a separate authfile.
• Regression test now asserts the refire script contains the exact (pull_request_target) context and rejects the bare approved (pull_request)" variant that caused RC 8337.
• APPROVED-state guard tests now require both APPROVED and approved literals independently for qa and security.
• Direct-trigger side remains in the previously acceptable shape: pull_request_review submitted, APPROVED guard, BASE/default-branch checkout, read-token evaluator, STATUS_POST_TOKEN POST, and exact BP-required context names.

CI/all-required is green. The remaining red qa/security/SOP contexts are expected for this gate-repair PR and do not change this CR2 verdict.

APPROVED on head 1b8b7a70, superseding RC 8337. Re-review result: the round-2 fix closes the blocker. Verified: - `review-refire-status.sh` now posts `CONTEXT="${TEAM}-review / approved (pull_request_target)"`, which resolves byte-for-byte to the BP-required `qa-review / approved (pull_request_target)` and `security-review / approved (pull_request_target)` contexts. - Refire read/write separation is preserved: evaluator stays on `GITEA_TOKEN` (`SOP_TIER_CHECK_TOKEN || GITHUB_TOKEN` from the workflow), while POST uses `STATUS_POST_TOKEN` via a separate authfile. - Regression test now asserts the refire script contains the exact `(pull_request_target)` context and rejects the bare `approved (pull_request)"` variant that caused RC 8337. - APPROVED-state guard tests now require both `APPROVED` and `approved` literals independently for qa and security. - Direct-trigger side remains in the previously acceptable shape: `pull_request_review` submitted, APPROVED guard, BASE/default-branch checkout, read-token evaluator, `STATUS_POST_TOKEN` POST, and exact BP-required context names. CI/all-required is green. The remaining red qa/security/SOP contexts are expected for this gate-repair PR and do not change this CR2 verdict.

hongming merged commit ef90e5a279 into main 2026-06-03 00:55:44 +00:00

molecule-code-reviewer referenced this pull request 2026-06-03 00:59:48 +00:00

feat(workspace-server): rescue read endpoint (internal#742 Part 3) #2020

molecule-code-reviewer referenced this pull request 2026-06-03 00:59:48 +00:00

feat(workspace-server): rescue read endpoint (internal#742 Part 3) #2020

molecule-code-reviewer referenced this pull request 2026-06-03 01:00:26 +00:00

feat(workspace-server): rescue read endpoint (internal#742 Part 3) #2020

molecule-code-reviewer referenced this pull request 2026-06-03 01:03:50 +00:00

[gate-fix] Direct auto-trigger does not fire qa/security workflows (refire backstop works) — needs live-run diagnosis #2159

molecule-code-reviewer referenced this pull request 2026-06-03 01:12:10 +00:00

ci(gate): add pull_request_review fallback trigger for qa/security review workflows #2153

core-be referenced this issue from a commit 2026-06-03 01:36:26 +00:00

docs+test(gate): codify PR-head workflow-selection rule + add live-fire + stale-head regression tests (#2159)

core-be referenced this issue from a commit 2026-06-03 01:40:54 +00:00

docs+test(gate): codify PR-head workflow-selection rule + add live-fire + stale-head regression tests (#2159)

core-be referenced this pull request 2026-06-03 01:43:34 +00:00

docs+test(gate): codify PR-head workflow-selection rule + add live-fire + stale-head regression tests (#2159) #2163

fullstack-engineer referenced this pull request 2026-06-03 20:51:02 +00:00

ci(gate): add pull_request_review fallback trigger for qa/security review workflows #2153

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#2157