feat(triage): generalize workflow-change block into block_auto_promotion - #1078
feat(triage): generalize workflow-change block into block_auto_promotion#1078rh-hemartin wants to merge 1 commit into
Conversation
PR Summary by QodoGeneralize triage auto-promotion blocking with reasons
AI Description
Diagram
High-Level Assessment
Files changed (9)
|
|
🤖 Finished Review · ✅ Success · Started 11:45 AM UTC · Completed 12:06 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $9.18 |
Code Review by Qodo
1. triage.md adds agent directives
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
| # Drop paired line-start fenced code blocks. An unmatched opener is left | ||
| # in place so the remainder of the text is not deleted. Inline triple | ||
| # backticks (not at line start) are left unchanged. | ||
| strip_line_start_fences() { |
There was a problem hiding this comment.
1. Protected automation paths modified 📜 Skill insight § Compliance
This PR modifies protected agents/ and scripts/ paths, including triage instructions and executable automation. These governance/automation changes require human approval and must not be auto-approved.
| **Blocking auto-promotion:** Use the `block_auto_promotion` field in `triage_summary` to prevent the post-triage script from auto-promoting the issue to the code agent. Set `blocked: true` with a `reason` when: | ||
| - The fix requires modifying CI/pipeline configuration files (`.github/workflows/`, `.gitlab-ci.yml`, `.fullsend/.github/workflows/`, or enrolled-repo shim workflows) that the code agent cannot modify under current permissions. | ||
| - Any other condition where auto-dispatch would be premature. |
There was a problem hiding this comment.
2. triage.md adds agent directives 📜 Skill insight ⛨ Security
The changed prompt text directly instructs the triage agent to set and apply block_auto_promotion. This introduces agent-instruction patterns in a changed configuration/prompt file, which the checklist expressly prohibits.
Agent Prompt
## Issue description
The changed `agents/triage.md` content contains direct agent instructions, contrary to PR Compliance ID 1538322.
## Issue Context
The added text directs the agent to use `block_auto_promotion` and specifies when to set it. Rework the change so prohibited instruction patterns are not introduced in comments, strings, or configuration values.
## Fix Focus Areas
- agents/triage.md[383-389]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| BLOCKED=$(jq -r '.triage_summary.block_auto_promotion.blocked // empty' "${RESULT_FILE}") | ||
| BLOCK_REASON=$(jq -r '.triage_summary.block_auto_promotion.reason // empty' "${RESULT_FILE}") | ||
| if [[ -z "${BLOCKED}" ]]; then |
There was a problem hiding this comment.
3. False block still falls back 🐞 Bug ≡ Correctness
Using jq's // empty turns an explicit block_auto_promotion.blocked: false into an empty result, so a simultaneously present deprecated requires_workflow_changes: true incorrectly blocks promotion. This violates the documented rule that the deprecated field is consulted only when block_auto_promotion is absent.
Agent Prompt
## Issue description
An explicit `block_auto_promotion.blocked: false` is lost because jq's `//` treats `false` like a missing value, allowing the deprecated flag to override it.
## Issue Context
The schema permits both migration fields, while the documented precedence says `requires_workflow_changes` applies only when the new object is absent. Test the valid combination `blocked:false` plus `requires_workflow_changes:true`.
## Fix Focus Areas
- scripts/post-triage.src.sh[424-436]
- scripts/post-triage-test.sh[810-818]
- scripts/post-triage.sh[1349-1361]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
| if ($0 ~ /^```/) { | ||
| n++ | ||
| pos[n] = NR | ||
| } | ||
| } | ||
| END { | ||
| for (i = 1; i + 1 <= n; i += 2) { | ||
| for (j = pos[i]; j <= pos[i + 1]; j++) skip[j] = 1 |
There was a problem hiding this comment.
4. Fence stripping is bypassable 🐞 Bug ≡ Correctness
The sanitizer recognizes every line beginning with exactly three backticks as a delimiter, so valid tilde-fenced blocks are left intact and backtick-prefixed content inside a longer/matching fence can be mistaken for its close. Consequently the post-script can publish code content it claims to strip, or delete the wrong region of the triage comment.
Agent Prompt
## Issue description
The new sanitizer only detects `^```` and pairs matches by position rather than matching actual Markdown opening and closing delimiters. Valid fenced blocks can survive, and delimiter-like lines inside a block can terminate removal early.
## Issue Context
Track the opening delimiter character and length, accept both backtick and tilde fences, and only close on a compatible delimiter-only line. Add tests for tilde fences, longer backtick fences containing triple backticks, and non-closing backtick-prefixed lines.
## Fix Focus Areas
- scripts/post-triage.src.sh[76-97]
- scripts/post-triage-test.sh[608-618]
- scripts/post-triage.sh[1001-1022]
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
|
Risk Assessment: elevated (3/5) DetailsElevated risk maintained at 3, consistent with prior assessment: 9 files with 504 changed lines and large blast radius across the triage subsystem, 5 protected paths modified, test ratio at 0.22. Tier 2 continues to show very high fix/revert churn and high commit frequency, confirming an actively unstable area. Linked issue is well-scoped (priority/medium feature) which provides mild downward pressure, but the sustained Tier 2 churn keeps the composite at elevated. Previous runRisk Assessment: elevated (3/5) DetailsElevated risk (up from prior moderate): 9 files with 504 changed lines and large blast radius across the triage subsystem, 5 protected paths modified, test ratio at 0.22, and very high fix/revert churn (3-40 per file in 90d) indicating an actively unstable area; score increased from 2 to 3 due to blast radius upgrading to large and sustained high churn in Tier 2. Previous run (2)Risk Assessment: moderate (2/5) DetailsModerate risk: 9 files with 445 changed lines across the triage subsystem, 5 protected paths modified, no CI/dependency changes, established contributor, but elevated churn in the triage scripts and docs (20-36 commits in 30 days). |
ReviewFindingsMedium
Low
Previous runReviewFindingsMedium
Low
Previous run (2)ReviewFindingsHigh
Medium
Low
Next steps:
|
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
fa3c916 to
361fb43
Compare
|
🤖 Finished Review · ✅ Success · Started 12:42 PM UTC · Completed 1:02 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.68 |
fullsend-ai-review
Bot
added
risk/elevated
Superseded by updated review
fullsend-ai-review
Bot
added
the
requires-manual-review
Replace the single-purpose requires_workflow_changes boolean with a general-purpose block_auto_promotion object (blocked + reason). Workflow file detection now sets blocked=true with a reason; later gates can use the same field without a new post-script path. Keep requires_workflow_changes as a deprecated optional property for one release so lockstep-skewed agent output still validates. When block_auto_promotion is absent, the old boolean still blocks auto-promotion. The post-script appends the reason to the triage comment, sanitizes GHA workflow-command sequences, strips paired line-start fenced code blocks, and uses a held-for-review footer when auto-promotion is blocked. Signed-off-by: Hector Martinez <hemartin@redhat.com>
361fb43 to
f09b3d7
Compare
|
🤖 Finished Review · ✅ Success · Started 9:04 AM UTC · Completed 9:46 AM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high |
1 participant
Summary
Replace the single-purpose
requires_workflow_changesboolean with a general-purposeblock_auto_promotionobject (blocked+reason). Workflow-file detection now uses that field so later gates (effort scoring) can reuse the same post-script path and attach a reason.This is the first of two slices split from
feat/2207-effort-gating. Effort estimation is not in this PR.Ref fullsend-ai/fullsend#2207
Behavior
block_auto_promotion.blocked=trueappliestriagedinstead ofready-to-codeand appends the reason to the triage comment.triaged(feature, security, other) are unchanged.requires_workflow_changesstays optional in the schema for one release. Whenblock_auto_promotionis absent,requires_workflow_changes: truestill blocks auto-promotion.::sequences in the reason, strips paired line-start fenced code blocks from comments, and uses a held-for-review footer when auto-promotion is blocked.Test plan
bash scripts/post-triage-test.shbash scripts/validate-output-schema-test.sh