Skip to content

fix: branch-protection bypass actor + engines allowlist 加 glm #196

Closed

Description

@akushonkamen

背景

Phase A 回滚后的新鲜 code review 发现 2 个 P1/P2:

P1: branch-protection.ts 非法 bypass actor

  • 文件: `app/src/lib/deploy-pipeline/branch-protection.ts`
  • 问题: `actor_type: "Integration"` 的 `actor_id` 用了字符串名 "GitAutoDev Deploy",但 GitHub ruleset API 要求数字 App ID。当前代码要么 422 报错要么静默不匹配 —— bypass 既坏又违反 S7(dogfood 不该有 branch-protection 豁免)。
  • 修复: 删除整个 `bypass_actors` 块。S7 的唯一豁免是 `pipeline-fix` PR label(由 branch-protection workflow 校验,不是 ruleset)。

P2: engines/actions.ts ALLOWED_PROVIDERS 缺 glm

  • 文件: `app/src/app/settings/engines/actions.ts`
  • 问题: GLM 是默认 passthrough(见 CLAUDE.md),但 BYOK 表单的 allowlist 没有 `glm`。用户只能选 `custom` 临时绕开。
  • 修复: allowlist 加 `glm`。

Test plan

  • `pnpm typecheck` 0 errors
  • `pnpm test` 19/19 pass
  • reviewer 确认修复符合 S7

Activity

  1. github-actions commented on Jul 22, 2026

    @github-actions
    Contributor

    Thanks for this clear issue. Summary: (P1) remove the bypass_actors block from branch-protection.ts — the S7 pipeline-fix label is the sole branch-protection bypass, not a ruleset-level actor; (P2) add glm to ALLOWED_PROVIDERS in engines/actions.ts since GLM is the default passthrough. Your test plan looks solid — pnpm typecheck + pnpm test green, and the S7 reviewer confirm is a good call. Routing to development pipeline.

  2. akushonkamen commented on Jul 22, 2026

    @akushonkamen
    OwnerAuthor

    🤖 Claude self-acceptance (M8 workload=standard). accepted-by-claude applied — Module 4 develop-gate will pick this up. Maintainer may override with rejected.

  3. added
    accepted-by-claudeClaude self-acceptance after clarify loop (Module 4 trigger, distinct from maintainer accepted)
    verifyingModule 5 self-verify active
    on Jul 22, 2026
  4. added a commit that references this issue on Jul 22, 2026
    245af43
  5. github-actions commented on Jul 22, 2026

    @github-actions
    Contributor

    ⚠️ Module 4 produced no new commits (issue #57).

    Claude analysed the issue and concluded no code change is required — pre-sha == post-sha, so no commit was made. Downstream modules (pr-lifecycle → verify) will NOT fire.

    Maintainer action required:

    • Re-triage the issue — the acceptance criteria may already be satisfied by existing code
    • OR refine the issue body and re-dispatch code-generate.yml
    • OR close as not-actionable

    Workflow run

  6. added
    verifiedModule 5 self-verify passed
    and removed
    verifyingModule 5 self-verify active
    on Jul 22, 2026
  7. akushonkamen commented on Jul 22, 2026

    @akushonkamen
    OwnerAuthor

    ✅ Verify passed — Module 6 (test) engaged. PR: #197

  8. added
    testingModule 6 test active
    verifyingModule 5 self-verify active
    and removed
    verifyingModule 5 self-verify active
    on Jul 22, 2026
  9. akushonkamen commented on Jul 22, 2026

    @akushonkamen
    OwnerAuthor

    ✅ Verify passed — Module 6 (test) engaged. PR: #197

  10. added a commit that references this issue on Jul 22, 2026
    3b13531
  11. added a commit that references this issue on Jul 22, 2026
    2816b4c
  12. github-actions commented on Jul 22, 2026

    @github-actions
    Contributor

    ❌ Test: failed

    Field Value
    PR #197
    Workflow run https://github.com/akushonkamen/github-auto-dev-scaffold/actions/runs/29885066040

    Test framework: vitest v2.1.9

    Existing test suite: 19/19 passed, 3 files ✓
    ✓ deploy-pipeline.test.ts (10 tests)
    ✓ quota.test.ts (6 tests)
    ✓ stripe.test.ts (3 tests)

    Acceptance criteria coverage:
    ✗ P1: branch-protection.ts 删除 bypass_actors 块 (S7 合规修复) — NO COVERAGE
    (branch-protection.ts 没有任何测试; 现有 deploy-pipeline tests 只覆盖 parseLabelsYml, DEFAULT_VARS, diffVars)
    ✗ P2: engines/actions.ts ALLOWED_PROVIDERS 加 'glm' — NO COVERAGE
    (actions.ts 没有任何测试; ALLOWED_PROVIDERS set 和 provider 校验逻辑完全未测试)

    Outcome: 19/19 tests pass, but both P1 and P2 acceptance criteria have zero test coverage. 这是重大缺口: S7 合规修复和 glm provider 添加均未经测试验证。

  13. added
    test:retry-1Auto-retry 1/3: re-running Module 4 with test feedback
    and removed
    testingModule 6 test active
    verifiedModule 5 self-verify passed
    on Jul 22, 2026
  14. akushonkamen commented on Jul 22, 2026

    @akushonkamen
    OwnerAuthor

    🔄 Auto-retry 1/3

    Field Value
    Retry 1 of 3
    Prior workflow run https://github.com/akushonkamen/github-auto-dev-scaffold/actions/runs/29885066040
    Retry label test:retry-1

    Failure summary (prior Module 6 run)

    Test framework: vitest v2.1.9

    Existing test suite: 19/19 passed, 3 files ✓
    ✓ deploy-pipeline.test.ts (10 tests)
    ✓ quota.test.ts (6 tests)
    ✓ stripe.test.ts (3 tests)


    code-generate.yml will auto-trigger on the test:retry-1 label,
    fetch this comment as the prior-test-report, and re-run Module 4 to
    fix the failure.

  15. github-actions commented on Jul 22, 2026

    @github-actions
    Contributor

    ⚠️ code-generate failed. See workflow run for details. A maintainer will triage manually.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    accepted-by-claudeClaude self-acceptance after clarify loop (Module 4 trigger, distinct from maintainer accepted)stage:failedA module failed; needs maintainer triagetest:retry-1Auto-retry 1/3: re-running Module 4 with test feedbacktriageNewly opened; awaiting triage bot

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions