[randoneering]

Pull Request Summary

The two weekly scraper workflows have been failing silently since Sep 9. They run every Monday, exit green, but no PR ever lands. The bug is in how peter-evans/create-pull-request handles the case where the source branch is gone from origin: it stashes the uncommitted proposal, sees zero commits ahead of base, and walks away. No error, no warning, just nothing.

Both source branches got cleaned up by hand on Sep 9 and 10 after PRs #42 and #45 merged. Since then, release-notes-scout has been finding 20 real bug proposals every week and throwing them away. data/known_bugs.json hasn't been touched since Sep 7 even though PG 15.18, 15.19, 16.15, 17.11, and 18.6 release notes have piled up since.

This PR fixes it by committing the proposal file before peter-evans runs, so the source branch is non-empty in both the "branch exists" and "branch missing" paths.

Type of Change

• New health check
• Bug fix
• Performance improvement
• Documentation update
• Refactoring/code cleanup
• Breaking change

---

Related Issues

No GitHub issue filed. Follows from PR #45, which was the last successful scraper run.

---

Testing

Ran locally before opening:

• uv run pytest -q tools/tests/ → 55 passed (covers both scraper scripts and their HTML fixtures)
• uv run pytest -q testing/test_workflow_security.py → 10 passed (covers the workflow-security regression suite)
• Both workflow YAMLs parse cleanly via yaml.safe_load; both jobs now have 7 steps (was 6)
• Throwaway-repo simulation of the new step: git rev-list --right-only --count main..HEAD returns 1 after the commit, proving the source branch is no longer empty

PostgreSQL Version Compatibility

N/A. This PR only edits GitHub Actions YAML. No SQL, no Python runtime change.

Managed Database Platforms

N/A. Same reason.

---

Additional Notes

Why peter-evans silently fails

From the Sep 29 run logs:

01:29:12.202Z  git stash push --include-untracked
01:29:12.219Z  git fetch origin chore/release-notes-scout
01:29:12.459Z  fatal: couldn't find remote ref chore/release-notes-scout
01:29:12.469Z  Branch 'chore/release-notes-scout' is not ahead of base 'main' and will not be created

The action stashes uncommitted work, fails to find the source branch, creates a new branch at HEAD, runs git rev-list --right-only --count main...branch, sees 0, and bails. The stash never gets popped, the proposal file gets discarded, and the run is marked success because no command exited non-zero.

Fix shape

      - name: Run scraper (CI mode)
        ...
        if [ $rc -eq 1 ]; then
          echo "needs_pr=true" >> "$GITHUB_OUTPUT"
          echo "$PROPOSED" > proposed-cves.json
        ...

+      - name: Commit proposed additions
+        if: steps.scrape.outputs.needs_pr == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add proposed-cves.json
+          git commit -m "chore: scrape PGDG for new CVEs"
+
      - name: Open PR with proposed additions
        if: steps.scrape.outputs.needs_pr == 'true'

Same shape in release-notes-scout.yml for proposed-bugs.json with commit message chore: scout release notes for new bug fixes. The peter-evans add-paths and commit-message inputs stay as-is for the existing-branch path.

Follow-up after merge

I held off on triggering workflow_dispatch until this lands. After merge, dispatching release-notes-scout.yml should open a PR with the 20 accumulated proposals so they can get curated into data/known_bugs.json.

[qodo-code-review]

PR Summary by Qodo

Commit scraper proposals before creating pull requests

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Commit generated proposals before PR creation so deleted source branches cannot silently suppress
 new PRs.
• Apply the fix to both the PGDG CVE scraper and release-notes scout workflows.

Diagram

graph TD
  A["Scraper run"] --> B{"Proposals found?"} -->|Yes| C["Commit proposal"] --> D["PR action"] --> E["Review PR"]
  B -->|No| F["Finish job"]

Loading

High-Level Assessment

Keep the existing PR action and commit proposals before invoking it. Replacing the action with custom branch and PR management would add complexity without addressing the failure more directly.

Files changed (2) +28 / -0

Bug fix (2) +28 / -0

pgdg-cve-scraper.ymlCommit CVE proposals before PR creation +14/-0

Commit CVE proposals before PR creation

• Adds a conditional step that commits proposed-cves.json with the GitHub Actions bot identity before the PR action runs. This gives runs with new CVEs a commit even when the source branch was deleted.

.github/workflows/pgdg-cve-scraper.yml

release-notes-scout.ymlCommit bug proposals before PR creation +14/-0

Commit bug proposals before PR creation

• Adds the corresponding conditional commit for proposed-bugs.json before the PR action. This prevents a missing source branch from causing release-notes proposals to be silently skipped.

.github/workflows/release-notes-scout.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review