fix: address issues #153-#156 (App wf fallback, test hardening, ruleset strict=false, coverage tests)

- #153: auto-approve now falls back to GITHUB_TOKEN for auto-merge on wf-touching PRs (conditional App token creation); removes hard dependency on workflows:write grant.
- #154: added normalize/CRLF test case exercising pure helper in initializeProject.
- #155: bumped e2e managed/MCP timeouts to 60s for cold-start robustness.
- #156: updated live ruleset strict_required_status_checks_policy=false; release PRs now merge reliably when green.

Closes #153
Closes #154
Closes #155
Closes #156

All via npm run check (clean), double-checked, subagent reviewer passed (mostly ready, followed suggestions for full gate + draft PR flow).

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

.github/workflows/auto-approve.yml

@@ -34,26 +34,27 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh pr review --approve "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}"
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event.pull_request.user.login != 'patchloom-release[bot]'
-        id: app-token
-        with:
-          client-id: ${{ vars.APP_CLIENT_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-
-      - name: Check for workflow file changes (to avoid App token needing workflows:write)
+      # Check for workflow file changes early (to decide whether we can safely use App token for auto-merge)
+      - name: Check for workflow file changes (use GITHUB_TOKEN fallback to avoid needing workflows:write on App)
         id: wf-changes
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           pr="${{ github.event.pull_request.number }}"
           if gh pr view "$pr" --json files --jq '.files[].path' | grep -q '^\.github/workflows/'; then
             echo "changes=true" >> "$GITHUB_OUTPUT"
-            echo "PR touches .github/workflows/; will skip auto-merge (App lacks workflows:write)"
+            echo "PR touches .github/workflows/; will use GITHUB_TOKEN for auto-merge (no workflows:write needed on App)"
           else
             echo "changes=false" >> "$GITHUB_OUTPUT"
           fi
 
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        if: github.event.pull_request.user.login != 'patchloom-release[bot]' && steps.wf-changes.outputs.changes != 'true'
+        id: app-token
+        with:
+          client-id: ${{ vars.APP_CLIENT_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
       # Strong guard against accidental/automated release PR merges is also
       # implemented here (label check below) and via scripts/guard-no-release-merge.sh.
       # See AGENTS.md "Release PRs - Strong Guard" section.
@@ -72,11 +73,10 @@ jobs:
             echo "is_release_pr=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Enable auto-merge
+      - name: Enable auto-merge (App token when no wf changes; GITHUB_TOKEN fallback otherwise)
         if: >-
           github.event.pull_request.user.login != 'patchloom-release[bot]' &&
-          steps.wf-changes.outputs.changes != 'true' &&
           steps.release-guard.outputs.is_release_pr != 'true'
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
         run: gh pr merge --auto --squash "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}"

AGENTS.md

@@ -126,6 +126,12 @@ All I/O-dependent functions accept an `inputs` object with injectable callbacks
 - All relative imports must use `.js` extensions (`from "./foo.js"`, not `from "./foo"`). Required by `moduleResolution: "node16"`.
 - All commits require a `Signed-off-by` line (DCO). Use `git commit -s`.
 - When adding commands to `package.json`, update the expected count in `test/suite/index.ts`.
+- **Branch & PR workflow (never push a branch and stop):** For any trackable work,
+  after the first `git push` immediately create a draft PR (`gh pr create --draft`).
+  Continue development with normal `git push` (updates the draft PR + CI).
+  Only run `gh pr ready <number>` (and enable auto-merge if needed) when the
+  changes are ready for review/merge. This ensures every pushed branch is
+  backed by an open (draft) PR from the start. See `~/.grok/skills/owned-repo-gate/SKILL.md`.
 
 ## Release PRs - Strong Guard
 

test/unit/initializeProject.test.ts

@@ -53,6 +53,12 @@ test("classifyAgentsFile detects real content drift", () => {
   assert.equal(classifyAgentsFile("# Rules\n- One\n", "# Rules\n- Two\n"), "different");
 });
 
+test("normalizeForComparison (via classify) ignores trailing whitespace and normalizes line endings", () => {
+  // indirectly exercises normalizeForComparison
+  assert.equal(classifyAgentsFile("# Rules\n- One \n \n", "# Rules\n- One\n"), "up_to_date");
+  assert.equal(classifyAgentsFile("# Rules\r\n- One\r\n", "# Rules\n- One\n"), "up_to_date");
+});
+
 test("buildStatusDetails includes workspace readiness context", () => {
   const details = buildStatusDetails(
     {

test/unit/patchloomCli.test.ts

@@ -647,16 +647,16 @@ describe("managed install end-to-end MCP", { timeout: 120_000 }, async () => {
 
   // Verify the binary is executable
   test("managed install produces a runnable binary", async () => {
-    // Cold start after fresh managed install can take >15s on some runners; use 30s.
-    const { stdout, stderr } = await execFileAsync(binaryPath, ["--version"], { timeout: 30000 });
+    // Cold start after fresh managed install can take >30s on some runners/CI; use 60s for robustness.
+    const { stdout, stderr } = await execFileAsync(binaryPath, ["--version"], { timeout: 60000 });
     const output = `${stdout}${stderr}`.trim();
     const version = parsePatchloomVersion(output);
     assert.ok(version, `should parse version from managed binary: ${output}`);
     assert.match(version, /^\d+\.\d+\.\d+/);
   });
 
   test("MCP server responds to initialize", async () => {
-    const child = execFile(binaryPath, ["mcp-server"], { timeout: 15000 });
+    const child = execFile(binaryPath, ["mcp-server"], { timeout: 60000 });
     let stdout = "";
     child.stdout!.on("data", (data: Buffer) => { stdout += data.toString(); });
 
@@ -690,7 +690,7 @@ describe("managed install end-to-end MCP", { timeout: 120_000 }, async () => {
   });
 
   test("MCP server lists available tools", async () => {
-    const child = execFile(binaryPath, ["mcp-server"], { timeout: 15000 });
+    const child = execFile(binaryPath, ["mcp-server"], { timeout: 60000 });
     let stdout = "";
     child.stdout!.on("data", (data: Buffer) => { stdout += data.toString(); });
 
@@ -765,7 +765,7 @@ describe("managed install end-to-end MCP", { timeout: 120_000 }, async () => {
     const workDir = await fs.mkdtemp(path.join(os.tmpdir(), "patchloom-mcp-call-"));
     await fs.writeFile(path.join(workDir, "config.json"), '{"port": 3000}\n', "utf8");
 
-    const child = execFile(binaryPath, ["mcp-server"], { timeout: 15000, cwd: workDir });
+    const child = execFile(binaryPath, ["mcp-server"], { timeout: 60000, cwd: workDir });
     let stdout = "";
     child.stdout!.on("data", (data: Buffer) => { stdout += data.toString(); });