From fd6bdaf499d2a371886a09a75463a42ab5d28d18 Mon Sep 17 00:00:00 2001 From: Sander Saares Date: Tue, 14 Jul 2026 13:56:29 +0300 Subject: [PATCH 1/6] ci(semver): restore sticky PR comment for version-increment check The semver-check job posted a fresh PR comment on every push, cluttering PRs with duplicates. Restore the marocchino/sticky-pull-request-comment action (header: semver-check) so the per-crate report is maintained as a single comment updated in place. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 69895436-a324-4370-b552-22d64a3369e4 --- .github/workflows/main.yml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 056a410ad..0e2a73987 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -202,8 +202,9 @@ jobs: # whose `version =` is bumped in this PR (the "publishing set"). The baseline # rustdoc is rebuilt from that commit's source, so no registry access is needed # and the check behaves identically for OSS and enterprise/offline consumers. - # The job is informational only: it never fails the build and posts a fresh PR - # comment on every push with a per-crate table (baseline vs this-PR vs the + # The job is informational only: it never fails the build and maintains a + # single sticky PR comment (keyed by the `semver-check` header, updated in + # place on each push) with a per-crate table (baseline vs this-PR vs the # minimum required version) plus a link to the run. It is a no-op on PRs that # do not bump any crate version, since only version-bumping PRs trigger a # publish and thus need a compatibility check against the previous version. @@ -249,14 +250,16 @@ jobs: git fetch --no-tags origin "+refs/heads/${env:BASE_REF}:refs/remotes/origin/${env:BASE_REF}" ./scripts/ci/semver-report.ps1 -BaseRef "origin/${env:BASE_REF}" -ReportPath semver-comment.md -RunUrl "${env:RUN_URL}" - # Post a NEW comment on every push (not a sticky update) so each run's - # result is visible in the PR timeline. Only fires when the PR actually - # publishes something and is not from a fork (forks lack a write token). + # Maintain a single sticky PR comment (keyed by the `semver-check` header) + # so each push updates the same comment in place instead of adding a new one. + # Only fires when the PR actually publishes something and is not from a fork + # (forks lack a write token). - name: Post Semver Comment if: steps.report.outputs.publishing == 'true' && github.event.pull_request.head.repo.full_name == github.repository - env: - GH_TOKEN: ${{ github.token }} - run: gh pr comment ${{ github.event.pull_request.number }} --body-file semver-comment.md + uses: marocchino/sticky-pull-request-comment@v3.0.4 + with: + header: semver-check + path: semver-comment.md extended-analysis: name: extended-analysis (${{ matrix.os }}) From 601e07ce08dfb8f76e3ba3787f4ed1d0c8024bbe Mon Sep 17 00:00:00 2001 From: Sander Saares Date: Tue, 14 Jul 2026 14:05:00 +0300 Subject: [PATCH 2/6] ci(semver): make check execution blocking, verdict informational The version-increment verdict stays informational (an under-increment never fails the build), but the check must actually execute: drop continue-on-error from the Semver Report step so an operational failure blocks and gets fixed rather than being silently skipped. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 69895436-a324-4370-b552-22d64a3369e4 --- .github/workflows/main.yml | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 0e2a73987..228980a3a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -202,12 +202,16 @@ jobs: # whose `version =` is bumped in this PR (the "publishing set"). The baseline # rustdoc is rebuilt from that commit's source, so no registry access is needed # and the check behaves identically for OSS and enterprise/offline consumers. - # The job is informational only: it never fails the build and maintains a - # single sticky PR comment (keyed by the `semver-check` header, updated in - # place on each push) with a per-crate table (baseline vs this-PR vs the - # minimum required version) plus a link to the run. It is a no-op on PRs that - # do not bump any crate version, since only version-bumping PRs trigger a - # publish and thus need a compatibility check against the previous version. + # The version-increment VERDICT is informational: an under-incremented crate is + # reported (status=fail) but never fails the build. The check must, however, + # actually run — an operational failure (script/tooling error, or a failure to + # post the comment) is intentionally BLOCKING so a broken check gets fixed + # rather than silently skipped. Results are shown in a single sticky PR comment + # (keyed by the `semver-check` header, updated in place on each push) with a + # per-crate table (baseline vs this-PR vs the minimum required version) plus a + # link to the run. It is a no-op on PRs that do not bump any crate version, + # since only version-bumping PRs trigger a publish and thus need a compatibility + # check against the previous version. semver: needs: [delta] if: github.event_name == 'pull_request' && needs.delta.outputs.skip != 'true' @@ -237,10 +241,12 @@ jobs: # its API changes; warn = a baseline could # not be determined so a check is # incomplete; pass = all sufficient) - # Kept non-failing so a git/tooling hiccup never blocks the PR. + # The version-increment verdict is informational (an under-increment sets + # status=fail, but the script still exits 0). This step is intentionally + # NOT continue-on-error: an operational failure here (git/tooling error) + # must block so the check gets fixed rather than silently skipped. - name: Semver Report id: report - continue-on-error: true shell: pwsh env: BASE_REF: ${{ github.base_ref }} From 4d7000c6555e3886232e07eb4c67274b3e32f150 Mon Sep 17 00:00:00 2001 From: Sander Saares Date: Tue, 14 Jul 2026 17:37:20 +0300 Subject: [PATCH 3/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index cbf22b18e..6d4a19e76 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -262,7 +262,7 @@ jobs: # (forks lack a write token). - name: Post Semver Comment if: steps.report.outputs.publishing == 'true' && github.event.pull_request.head.repo.full_name == github.repository - uses: marocchino/sticky-pull-request-comment@v3.0.4 +uses: marocchino/sticky-pull-request-comment@468942ec889968f45256a969e13c75bc7cdec2b6 # v3.0.4 with: header: semver-check path: semver-comment.md From 3aec950a62adc91e841564921e2897bf1391bc67 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 15 Jul 2026 09:08:30 +0000 Subject: [PATCH 4/6] fix(ci): fix indentation of uses: under Post Semver Comment step --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 6d4a19e76..aa72b5a0b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -262,7 +262,7 @@ jobs: # (forks lack a write token). - name: Post Semver Comment if: steps.report.outputs.publishing == 'true' && github.event.pull_request.head.repo.full_name == github.repository -uses: marocchino/sticky-pull-request-comment@468942ec889968f45256a969e13c75bc7cdec2b6 # v3.0.4 + uses: marocchino/sticky-pull-request-comment@468942ec889968f45256a969e13c75bc7cdec2b6 # v3.0.4 with: header: semver-check path: semver-comment.md From 2db6b401bdc3b642e09d78319d785213925567f1 Mon Sep 17 00:00:00 2001 From: Sander Saares Date: Wed, 15 Jul 2026 15:59:42 +0300 Subject: [PATCH 5/6] fix(ci): correct pinned SHA for sticky-pull-request-comment v3.0.4 The previously pinned SHA 468942ec... does not exist in the action repository, causing 'Unable to resolve action' failures. Repin to the actual v3.0.4 commit 0ea0beb6. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 211016fc-e620-4970-9889-509bdc8277ed --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index aa72b5a0b..5346542f8 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -262,7 +262,7 @@ jobs: # (forks lack a write token). - name: Post Semver Comment if: steps.report.outputs.publishing == 'true' && github.event.pull_request.head.repo.full_name == github.repository - uses: marocchino/sticky-pull-request-comment@468942ec889968f45256a969e13c75bc7cdec2b6 # v3.0.4 + uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4 with: header: semver-check path: semver-comment.md From 50fe89fb9a6d54d51cb876ebc20255b7424d520b Mon Sep 17 00:00:00 2001 From: Sander Saares Date: Wed, 15 Jul 2026 17:01:57 +0300 Subject: [PATCH 6/6] fix(ci): grant contents:read to semver job permissions Job-level permissions override the workflow default, setting all unspecified scopes to none. The semver job runs actions/checkout and git fetch, which require contents:read, so declare it explicitly alongside pull-requests:write (mirrors the codeql job convention). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 211016fc-e620-4970-9889-509bdc8277ed --- .github/workflows/main.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 5346542f8..426f9c86a 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -217,6 +217,7 @@ jobs: if: github.event_name == 'pull_request' && needs.delta.outputs.skip != 'true' runs-on: ubuntu-latest permissions: + contents: read pull-requests: write steps: # prep