Skip to content

feat(ci): add bounded retries for approved pull requests - #340

Merged
Piotr1215 merged 3 commits into
mainfrom
devops-1758/approved-pr-ci-retry
Nov 5, 2026
Merged

Piotr1215 merged 3 commits into
mainfrom
devops-1758/approved-pr-ci-retry

Conversation

@Piotr1215

@Piotr1215 Piotr1215 commented Oct 30, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Add an opt-in action to retry failed CI on approved pull requests. It defaults to disabled and dry-run mode. Callers must allowlist workflow IDs.

The action requires a current-head approval from a human with write access and skips drafts, forks, stale heads, and unknown API state. It rechecks eligibility before requesting one failed-jobs rerun. The limit is three reruns, including manual attempts.

When the limit is exhausted, it emits a JSON handoff with immutable run details. It does not approve or merge pull requests or invoke the QA bot. No caller is activated, and the action is not released yet.

Test plan

54 tests passed. All six GitHub checks passed on 20f704f, including actionlint, zizmor and generated docs. Targeted local zizmor found no issues.

Full make lint reports an existing dangerous-triggers finding in .github/workflows/claude.yml with local zizmor 1.31.1. The live event chain has not been verified.

Closes DEVOPS-1758

@Piotr1215
Piotr1215 requested a review from a team as a code owner October 30, 2026 10:12

@vcauesantos vcauesantos left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - Retrying approved PRs until they pass might hide flaky tests, we need to keep an eye on this.

@Piotr1215
Piotr1215 force-pushed the devops-1758/approved-pr-ci-retry branch 2 times, most recently from be19879 to e1876bb Compare November 3, 2026 08:52
Approved pull requests can leave authors repeating failed CI by hand. Existing approval automation waits for green checks but cannot request a rerun.

Add a disabled, dry-run-first retry action with an explicit workflow allowlist, current-head human approval, freshness checks and a three-rerun budget that includes manual attempts. Leave an immutable diagnosis handoff when the budget is exhausted. Keep merges and AI dispatch outside this pilot until their policies and input contract are verified.
@Piotr1215
Piotr1215 force-pushed the devops-1758/approved-pr-ci-retry branch from e1876bb to c9402c3 Compare November 4, 2026 11:29
PR #340 cannot merge after 9efa8d7 added the registry guard to the same shared test lists. Keep both actions in the phony targets and aggregate test prerequisites so neither suite is lost when the branches come together.

Closes DEVOPS-1758
PR #340 cannot merge after 4f3e6f6 adds the image cleanup test target in the same Makefile lists as the retry suite. Preserve both suites in the phony targets and aggregate test recipe so neither loses coverage when the branch is merged.
@Piotr1215
Piotr1215 merged commit bd4e838 into main Nov 5, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants