fix: stop serializing stranded-PR healing behind each other's CI wait - #3
Conversation
heal-stranded-prs regenerated or rebased each stranded sibling-update PR and then waited out that branch's full CI cycle before moving to the next candidate, all inside one job with a single timeout. Once more than a couple of PRs went stranded at once, the CI wait for the first one or two candidates routinely consumed the whole timeout, and the job was cancelled before reaching the rest -- starving whichever PRs sorted later, which were consistently the oldest, most overdue ones. Split into discover-stranded-prs (git operations only, oldest-candidate first, never waits on CI) and wait-and-merge-healed-prs (one job per healed branch via a matrix strategy, so however many PRs got healed wait out their CI cycles in parallel instead of queued one behind another).
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 6ab3711663
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
…olation
wait-and-merge-healed-prs interpolated matrix.branch straight into a run:
script body. That branch name traces back to a PR's own headRefName, which
git accepts containing shell metacharacters, and GitHub splices ${{ }}
expressions into the script text before bash ever parses it -- a crafted
branch name could execute arbitrary commands with this job's write-capable
App token. Bind pr_url/head_sha/branch through the step's env block instead,
so they reach the script as data rather than as script text.
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
🎉 This PR is included in version 1.0.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Splits heal-stranded-prs into discover-stranded-prs (fast git operations only -- rebase or regenerate each candidate branch, oldest-created first, never waiting on CI) and wait-and-merge-healed-prs (a matrix job, one per healed branch, waiting out its own CI cycle before rebase-merging).
Found while investigating why novus-power/hive#1584 stayed stuck: a backlog of several sibling-update PRs meant the single job's CI wait for the first one or two candidates ate its whole timeout, and it was cancelled before ever reaching the older, longer-stranded ones. Oldest-first ordering plus parallel per-PR merge jobs fixes the starvation regardless of how large the backlog gets.