ci(competition): ledger sweeps merged prs - auto-merge pushes fire no events

round 1 (pr #566) proved the gap live: the gate arms auto-merge with the
workflow GITHUB_TOKEN, and github suppresses workflow triggers for
pushes caused by that token, so the merge push never reached the ledger.
the workflow now sweeps recently merged ladder prs (schedule + manual
dispatch + the still-working push path for human merges); the appender
stays idempotent per pr, so overlapping sweeps converge.

Author: plind-junior

.github/workflows/koth-ledger.yml

@@ -1,54 +1,60 @@
-# appends the dethrone row to competition/LEADERBOARD.md after a win lands
-# on the ladder branch. the scoring gates stay read-only by design (the
-# engine gate holds no write token at all); this workflow never runs on a
-# PR event — only on push to the ladder branch, after the merge, from
-# base-branch code — so an untrusted PR can never reach its write token.
-# idempotent: update_leaderboard.py no-ops when the PR is already cited,
-# so the workflow triggering on its own ledger push converges.
+# appends dethrone rows to competition/LEADERBOARD.md for merged ladder
+# PRs. the scoring gates stay read-only by design (the engine gate holds
+# no write token at all); this workflow never runs on a PR event, so an
+# untrusted PR can never reach its write token.
+#
+# it is a SWEEP, not a per-push hook: the gate arms auto-merge with the
+# workflow GITHUB_TOKEN, and github's recursion guard suppresses workflow
+# triggers for pushes caused by that token — so an auto-merged dethrone
+# never fires a push event here (round 1, PR #566, proved it live). the
+# push trigger still catches human-merged rows immediately; the schedule
+# and manual dispatch pick up auto-merged ones. update_leaderboard.py is
+# idempotent per PR, so overlapping sweeps converge instead of duplicating.
 name: koth-ledger
 on:
   push:
+  schedule:
+    - cron: "17 */6 * * *"
+  workflow_dispatch:
 permissions: {}
 concurrency:
-  group: koth-ledger-${{ github.ref_name }}
+  group: koth-ledger
   cancel-in-progress: false
 jobs:
   ledger:
     if: >-
       vars.KOTH_LADDER_BASE != '' &&
-      github.ref_name == vars.KOTH_LADDER_BASE &&
-      !startsWith(github.event.head_commit.message, 'docs(competition): ledger row')
+      (github.event_name != 'push' ||
+       (github.ref_name == vars.KOTH_LADDER_BASE &&
+        !startsWith(github.event.head_commit.message, 'docs(competition): ledger row')))
     runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: read
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.ref_name }}
+          ref: ${{ vars.KOTH_LADDER_BASE }}
 
-      - name: find the merged pr and its scorecard comment
-        id: scorecard
+      - name: append rows for recently merged ladder prs
         env:
           GH_TOKEN: ${{ github.token }}
-          SHA: ${{ github.sha }}
+          LADDER: ${{ vars.KOTH_LADDER_BASE }}
         run: |
-          pr_json="$(gh api "repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls" \
-            --jq '[.[] | select(.merged_at != null)][0] // empty')"
-          if [ -z "$pr_json" ]; then
-            echo "no merged pr for ${SHA}; nothing to ledger"
-            echo "found=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          pr_number="$(printf '%s' "$pr_json" | jq -r '.number')"
-          pr_author="$(printf '%s' "$pr_json" | jq -r '.user.login')"
-          # only the gate's own comments are trusted: a scorecard-shaped
-          # comment from anyone else must never reach the ledger
-          gh api "repos/${GITHUB_REPOSITORY}/issues/${pr_number}/comments" \
-            --paginate \
-            --jq '.[] | select(.user.login == "github-actions[bot]") | .body' \
-            > /tmp/comments.txt
-          python3 - <<'PYEOF'
+          gh pr list --repo "$GITHUB_REPOSITORY" --base "$LADDER" \
+            --state merged --limit 15 --json number,author \
+            --jq '.[] | "\(.number) \(.author.login)"' > /tmp/merged.txt
+          appended=0
+          while read -r pr author; do
+            [ -n "$pr" ] || continue
+            # only the gate's own comments are trusted: a scorecard-shaped
+            # comment from anyone else must never reach the ledger
+            gh api "repos/${GITHUB_REPOSITORY}/issues/${pr}/comments" \
+              --paginate \
+              --jq '.[] | select(.user.login == "github-actions[bot]") | .body' \
+              > /tmp/comments.txt || continue
+            rm -f /tmp/report.json
+            python3 - <<'PYEOF'
           import re
 
           body = open("/tmp/comments.txt", encoding="utf-8").read()
@@ -58,35 +64,22 @@ jobs:
               with open("/tmp/report.json", "w", encoding="utf-8") as fh:
                   fh.write(reports[-1])
           PYEOF
-          if [ ! -f /tmp/report.json ]; then
-            echo "no gate scorecard with a dethrone on pr ${pr_number}"
-            echo "found=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "found=true" >> "$GITHUB_OUTPUT"
-          echo "pr=${pr_number}" >> "$GITHUB_OUTPUT"
-          echo "author=${pr_author}" >> "$GITHUB_OUTPUT"
+            if [ -f /tmp/report.json ]; then
+              python3 .github/scripts/update_leaderboard.py \
+                --report /tmp/report.json --pr "$pr" --author "$author" \
+                && appended=1
+            fi
+          done < /tmp/merged.txt
+          echo "sweep done (appended=$appended)"
 
-      - name: append the ledger row
-        if: steps.scorecard.outputs.found == 'true'
-        env:
-          PR: ${{ steps.scorecard.outputs.pr }}
-          AUTHOR: ${{ steps.scorecard.outputs.author }}
-        run: |
-          python3 .github/scripts/update_leaderboard.py \
-            --report /tmp/report.json --pr "$PR" --author "$AUTHOR"
-
-      - name: commit the row
-        if: steps.scorecard.outputs.found == 'true'
-        env:
-          PR: ${{ steps.scorecard.outputs.pr }}
+      - name: commit the rows
         run: |
           if git diff --quiet -- competition/LEADERBOARD.md; then
-            echo "ledger unchanged (row already present)"
+            echo "ledger unchanged"
             exit 0
           fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add competition/LEADERBOARD.md
-          git commit -m "docs(competition): ledger row for #${PR}"
+          git commit -m "docs(competition): ledger rows from sweep"
           git push