fix(ci): waive gate attestation by PR author, not by github.actor - #69
Merged
Conversation
The trailer waiver tested `github.actor == 'dependabot[bot]' || github.actor == 'release-please[bot]'`. Neither value ever occurs on this repo's release PRs: release-please running under `GITHUB_TOKEN` opens its PR as `github-actions[bot]`. So the waiver never fired, the trailer check ran against generated version-bump commits that carry no trailer, and it failed. `gate-attestation` is a required check on main, so that is not advisory -- #58 is red on this and nothing else, and every future release PR would be too. `github.actor` is the wrong key even where the login matches: it is whoever caused the current run, so it flips to a maintainer login on "Re-run failed jobs" and re-arms the check on a bot PR that already passed. The waiver now keys off `github.event.pull_request.user.login` and additionally matches release-please branch-shaped, because the author varies across GITHUB_TOKEN and PAT operation while the branch name does not. Both are the conditions the fleet's canonical reusable workflow already uses. Trailer verification is also bound to the PR tip instead of scanning the whole PR commit range. The range form passed whenever any ancestor carried a trailer, so an unstamped tip could ride an earlier commit's attestation and the tree that actually merges was never gated. The job keeps its `gate-attestation` name, so the required-check context is unchanged. Migration to the shared reusable caller -- which does carry a required-check rename -- stays with kanon#2522. Refs #68 Gate-Passed: kanon 0.1.12 +stages:fmt,check,clippy,nextest,lint sha:d1159e7fc5b6e7b4df86d6a23e6568d6cd578382
Uh oh!
There was an error while loading. Please reload this page.
Merged
forkwright pushed a commit
that referenced
this pull request
Jul 28, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>0.2.0</summary> ## [0.2.0](v0.1.0...v0.2.0) (2026-07-28) ### Features * **_llm:** add T0 corpus per [#667](https://github.com/forkwright/hamma/issues/667) / [#673](https://github.com/forkwright/hamma/issues/673) fleet rollout ([#10](#10)) ([0568f51](0568f51)) * **control:** instrument async control client entry points ([#37](#37)) ([e80622f](e80622f)), closes [#20](#20) * **control:** support zstd map responses ([dd5ab90](dd5ab90)) * **dictyon:** add TCP/TLS connection, registration, and map streaming ([a311d8a](a311d8a)) * **dictyon:** control protocol types and map response parser ([dfc25c7](dfc25c7)) * **dictyon:** migrate tracing init to koinon ([e5a4260](e5a4260)) * **dictyon:** Noise IK handshake, key types, HTTP transport skeleton ([aafea4f](aafea4f)) * **dictyon:** trace wire noise transport phases ([#38](#38)) ([2d80231](2d80231)), closes [#20](#20) ### Bug Fixes * **cargo:** track lockfile for pinned rust toolchain ([#30](#30)) ([e6a2f01](e6a2f01)), closes [#29](#29) * **ci:** resolve cargo-deny + MSRV + binary smoke failures ([#13](#13)) ([9bb4533](9bb4533)) * **ci:** waive gate attestation by PR author, not by github.actor ([#69](#69)) ([764422e](764422e)), closes [#68](#68) * **control:** accept node id peer removals ([7debc6b](7debc6b)) * **control:** apply peer patch map deltas ([#33](#33)) ([dfc3731](dfc3731)) * **core:** parse peer patch map fields ([0686a66](0686a66)) * **deps:** clear RUSTSEC-2026-0190 via anyhow lockfile bump ([#56](#56)) ([2423485](2423485)) * **lint:** add non_exhaustive to public error enums, mark public-key fields ([0355297](0355297)) * **lint:** mechanical wins — allow→expect, indexing/slicing, casts, http→https ([9e339db](9e339db)) * **lint:** resolve clippy warnings in hamma-core and wire integration test ([#42](#42)) ([079ad5e](079ad5e)) * **lint:** suppress pub-visibility for library API surface ([6d54674](6d54674)) * **lint:** unblock kanon gate ([f93ff63](f93ff63)) * **release:** bump the internal hamma-core pin and Cargo.lock with the release ([#71](#71)) ([dfdfc35](dfdfc35)), closes [#70](#70) * resolve 1 lint violations via local ([#8](#8)) ([0d4aa84](0d4aa84)) ### Refactoring * **dictyon:** replace expect with ? and rename test helper ([#9](#9)) ([655b783](655b783)) * **lint:** split oversized modules; add hamma-core integration tests ([fa8f54f](fa8f54f)) * rename plegma→hamma, plegma-core→hamma-core ([a67f792](a67f792)) ### Documentation * add CLAUDE.md precedence preamble (forge[#153](https://github.com/forkwright/hamma/issues/153)) ([e91ebea](e91ebea)) * add CONTRIBUTING.md for 05e cutover ([#1](#1)) ([9dd5f87](9dd5f87)) * add llms.txt per kanon doc standards (refs [#10](#10)) ([#11](#11)) ([e869fe1](e869fe1)) * **agents:** add AGENTS.md per fleet repo-structure standard ([#40](#40)) ([0382da1](0382da1)) * **hamma:** align pre-alpha status ([#6](#6)) ([873a6c3](873a6c3)) * **hamma:** replace standards copy with kanon pointer ([#8](#8)) ([324ff18](324ff18)) * sanitize local bootstrap docs ([4c57d40](4c57d40)) * **standards:** add canonical standards from kanon ([#1](#1)) ([81e5007](81e5007)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the permanent block on release PRs described in #68.
gate-attestationwaived ongithub.actor == 'dependabot[bot]' || github.actor == 'release-please[bot]'. Neither value occurs on this repo's release PRs — release-please underGITHUB_TOKENopens them asgithub-actions[bot]— so the waiver never fired and the trailer check failed against generated version-bump commits. It is a required check onmain, so #58 is red on this and nothing else, and every future release PR would be too.Changes
github.event.pull_request.user.logininstead ofgithub.actor.github.actoris whoever caused the current run, so it flips to a maintainer login on "Re-run failed jobs" and re-arms the check on a bot PR that already passed.startsWith(github.head_ref, 'release-please--branches--')), because the author varies between GITHUB_TOKEN and PAT operation while the branch name does not.Both conditions match the fleet's canonical reusable at
forkwright/.github/.github/workflows/gate-attestation.yml; this is convergence toward it, not a new local dialect.Verification
kanon gate --tier fullgreen on this branch — fmt, check, clippy, nextest (78/78), deny, lint — and this commit carries itsGate-Passedtrailer, so the new tip-bound check is being asked to pass on its own terms.The job keeps its
gate-attestationname, so the required-check context is unchanged and no branch-protection edit is needed. Migration to the shared reusable caller — which does carry a required-check rename togate / gate— stays with kanon#2522.Refs #68