Fix two silent defects in the documented CI template

[devin-ai-integration]

Summary

A user report (defects #1 and #3) found that the template in /docs/config-as-code/ci-integration passes green on a config Ravion rejects, and permanently skips a merge whose apply run was cancelled or failed. Both are fixed here; defect #2 (unscoped project config apply) is not addressed — it needs a CLI or product decision.

1. The plan job no longer swallows the dry-run status. --dry-run is the only pre-merge validation a config gets, and || true threw its exit code away, so a 422 was rendered into the PR comment as if it were a diff. The failure is now counted per resource, keeping the comment (the errors are the useful output), and a final step after the comment fails the job:

rc=0
NO_COLOR=1 ravion project config apply "$id" --file "$file" --dry-run > "$plan_file" 2>&1 || rc=$?
[ "$rc" -eq 0 ] || failures=$((failures + 1))
# … build/post the comment, then a separate step:
#   if: steps.plan.outputs.failures != '' && steps.plan.outputs.failures != '0' -> exit 1

2. The push diff base is the last successful run, not github.event.before. before assumes every earlier push was applied; a cancelled queued run (any adopter adding concurrency) or a failed apply left that commit outside every later diff, so live stayed behind the repo forever. The shared list_changed_resources step now branches on the event:

BASE=$(gh run list --workflow "${workflow_file##*/}" --branch "$GITHUB_REF_NAME" \
  --event push --status success --limit 30 --json headSha \
  --jq "[.[].headSha | select(. != \"$HEAD\")] | first // empty")
BASE=${BASE:-$PUSH_BASE}   # no successful run yet, or its commit was rewritten away

$HEAD is excluded because a re-run of the current commit would otherwise diff it against itself, and an unfetchable sha (force push, expired retention) falls back to github.event.before. Pull requests keep using github.event.pull_request.base.sha. The workflow file name comes from GITHUB_WORKFLOW_REF so adopters who rename the file don't have to edit the command, and both jobs gain actions: read plus GH_TOKEN for the gh run list call.

mint validate passes; the YAML block parses with anchors intact and every run script passes bash -n.

Link to Devin session: https://app.devin.ai/sessions/3d501803e28b497e937c077a7f1ddb5b
Requested by: @flybayer

Greptile Summary

The documentation’s GitHub Actions template now preserves dry-run failures while still posting diagnostics and computes push changes from the last successful workflow run.

• Counts rejected project and pipeline plans and fails the pull-request check after posting the combined plan comment.
• Grants workflow-run read access and queries successful push history to recover configuration changes missed by cancelled or failed apply runs.
• Falls back to the push event base when no usable successful-run commit is available.

Confidence Score: 5/5

The pull request appears safe to merge, with no concrete changed-code defect identified.

The revised template correctly retains dry-run diagnostics before failing invalid plans and uses a guarded successful-run lookup with a fallback for push comparisons.

Important Files Changed

Filename	Overview
config-as-code/ci-integration.mdx	Updates the documented workflow’s plan failure propagation, GitHub permissions, and push comparison baseline without an accepted actionable defect.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  PR[Pull-request config change] --> DryRun[Dry-run each changed resource]
  DryRun --> Comment[Post combined plan comment]
  Comment --> Result{Any dry-run failures?}
  Result -->|Yes| Fail[Fail plan check]
  Result -->|No| Pass[Pass plan check]
  Push[Push to default branch] --> History[Find last successful push run]
  History --> Fetch{Commit available?}
  Fetch -->|Yes| Diff[Diff successful commit to HEAD]
  Fetch -->|No| Fallback[Use push event base]
  Fallback --> Diff
  Diff --> Apply[Apply changed Ravion resources]

Loading

_{Reviews (1): Last reviewed commit: "Fail the CI template's plan job on inval..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Configuration files and CI integration

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Ravion	🟢 Ready	View Preview	Aug 26, 2026, 1:38 PM

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring