feat(githubbot): skip centaur-skip checks, and read check detail without the Checks API - #1589
Open
oponder wants to merge 1 commit into
Open
feat(githubbot): skip centaur-skip checks, and read check detail without the Checks API#1589oponder wants to merge 1 commit into
oponder wants to merge 1 commit into
Conversation
…out the Checks API An approval gate that fails until a person signs off reads to githubbot as red CI: it spends every CI-fix attempt on a check no agent can turn green, then escalates. Checks with `centaur-skip` in their name are now dropped from the CI evaluation and from the escalation comment's failing list. The marker rides the job id because GitHub recomputes the check-run name every run, unlike workflowRun.workflow.name, which it caches per consuming repo for ruleset-injected required workflows and never refreshes. That filter needs readable check detail, and a fine-grained PAT — the token type GitHub recommends — has no Checks permission at all, so statusCheckRollup returns null check nodes. Today that silently degrades every deployment using one: failingNames is always empty, so fix turns are dispatched with "Failing checks: unknown" and escalations say "Still failing: the CI checks". When the nodes are unreadable, githubbot now rebuilds the checks from the Actions API, where a job is the same object as its check run. It trusts the reconstruction only when it accounts for every context GitHub counted — commit statuses and check runs from other Apps aren't Actions jobs — and otherwise keeps the existing aggregate behavior rather than call a PR green on a check it never saw. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NY7uaJuKZDbHdD9UaBQZVc
oponder
marked this pull request as ready for review
September 1, 2026 20:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes to githubbot's CI evaluation; the second is what makes the first work on a fine-grained PAT.
Skip a check. A check whose job id contains
centaur-skipis dropped from the CI evaluation and from the escalation comment's failing list. Some required checks can never be turned green by an agent — an N-human-approvals gate, a manual sign-off — and today githubbot burns all three fix attempts on them and then escalates. The marker rides the job id, which GitHub uses as the check-run name and recomputes every run, rather than the workflow name, which GitHub caches per consuming repo for ruleset-injected required workflows and never refreshes.Read check detail without the Checks API. A fine-grained PAT — the token type GitHub recommends — has no Checks permission, so
statusCheckRollupreturns null check nodes and the evaluation collapses to the bare aggregate:failingNamesis always empty, fix turns get "Failing checks: unknown", escalations say "Still failing: the CI checks". When the nodes are unreadable, githubbot now rebuilds the checks from the Actions API (a job is the same object as its check run) and trusts that only when it accounts for every context GitHub counted — commit statuses and other Apps' check runs aren't Actions jobs — otherwise it keeps the existing aggregate behaviour.No new configuration; auto-merge is untouched. Verified end-to-end on a deployment using a fine-grained PAT: gate-only red evaluates green, and gate plus a real failure fires exactly one fix turn that names only the real failure.
🤖 Generated with Claude Code
https://claude.ai/code/session_01NY7uaJuKZDbHdD9UaBQZVc