mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-02 13:01:34 +00:00
169dad6224
* fix(scripts): ignore superseded workflow runs in watch-pr-ci rollup classification Draft->ready re-triggers leave cancelled superseded runs on the head SHA forever, and GitHub's aggregate rollup state counts them, so the watcher emitted terminal FAILURE while the replacement run was still in progress and could never reach GREEN (observed on PR #113150, headbd1b9a0e). - fetch run identity per check and resolve same-name checks to the newest run/check id (GitHub latest-name-wins); drop cancelled checks from replaced runs; keep older runs' unique jobs visible - paginate statusCheckRollup contexts (bounded, 10 pages) so >100-context rollups are not truncation-blind; changed or lost snapshots throw into the bounded retry - classify GREEN when aggregate FAILURE is explained solely by superseded contexts with full visibility; truncation still fails conservatively * ci: scope GitHub App token permissions in stale, labeler, auto-response, and pr-ci-sweeper Fixes red main: #112963 bumped zizmor v1.22.0 -> v1.28.0, whose github-app audit flags create-github-app-token mints without permission-* inputs (14 high findings, Workflow Sanity red on main since3b7b2a2a1f). Most workflows already migrated to scoped tokens; these four were stragglers. Scopes follow each consumer's actual API surface: stale needs issues/PR write plus actions read for its state-cache check; labeler needs label CRUD (issues write), PR write, members read for maintainer gates, and contents read where actions/labeler reads its config; auto-response needs issues/PR write plus members read; pr-ci-sweeper needs actions write to re-fire runs, checks read, and PR write. Verified locally with the exact CI invocation (zizmor 1.28.0, repo config, regular persona, medium severity/confidence): no findings, ignore/suppress counts match CI.