fix(ci): supersede open flake-inputs update PR in place (#946) by dezren39 · Pull Request #1014 · developing-today/code

dezren39 · 2026-10-26T21:08:47Z

What

Implements the #946 fix in the flake-inputs-update workflow's publish step (.github/workflows/flake-inputs-update.yml), per the triage decision (queue task 1095): supersede an already-open automation update PR in place instead of stacking a duplicate.

The publish step now, before creating anything:

Lists open PRs whose head branch matches automation/flake-inputs-update-* (the workflow previously had no gh pr list at all and created a PR unconditionally).
Same revs (open PR title equals the title this run would use — the title encodes both revs): logs that it is reusing the open PR and skips publish entirely.
Older revs: fetches the existing branch, commits this run's computed flake.lock onto it, pushes to the same branch, and gh pr edits title/body to the new revs. No second PR; the PR's Fixes/handoff comments stay valid.
Fallback (in-place update fails, e.g. branch deleted): comments on the stale PR naming the replacement branch + run, closes it, and only then creates the replacement PR as before — two open automation update PRs never linger.

The computed flake.lock is copied aside before any branch switching and restored from that copy in both the update and fallback paths. Everything after publish (direct merge / auto-merge / handoff, failure-issue handling) is unchanged and simply operates on the reused-or-new pr_number.

PR #974 — the live handoff PR that motivated this — is not touched by this change; it remains the fixture the next workflow run will supersede in place.

Verification

YAML parses (python yaml.safe_load); publish-step script passes bash -n and shellcheck -s bash -S warning clean. (No actionlint in the sandbox; CI's checks will cover the workflow further.)
Dry-run over the three scenarios against the final script:
- No open PR: lookup yields empty; the create path is byte-for-byte today's behaviour (same branch naming, commit message, gh pr create).
- Open PR, older revs (the chore(deps): update openchamber to 89d8b085cad8 and opencode to 61c35a02284a #974 situation): fetch + checkout -f -B onto the automation branch, restore computed lock, commit, fast-forward push, gh pr edit — one PR, updated.
- Open PR, same revs: title comparison hits, publish skipped with a log line naming the reused PR; merge/handoff logic proceeds on that PR number.

Closes #946 once merged.

🤖 Queue worker (repo-worker-code), task 1148.

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

Chores
- Improved how automated update requests are managed: matching open requests can be reused, updated requests can refresh their branch and details, and requests that cannot be updated in place are closed before a replacement is created. Existing lockfile state is preserved during these operations.

…acking a duplicate (#946)

chatgpt-codex-connector · 2026-10-26T21:08:58Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T21:13:31.504776Z	`3c13a63`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-26T21:09:12Z

Caution

Review failed

The pull request is closed.

Walkthrough

The workflow now checks for an open flake-inputs update PR. It reuses a PR with matching pins, updates a PR with different pins when possible, or closes it and creates a replacement.

Changes: Flake inputs update PR

Layer / File(s)	Summary
Reuse or replace the update PR `.github/workflows/flake-inputs-update.yml`	The workflow saves the computed `flake.lock` and prepares the PR title. It searches for an open automation update PR, reuses it when its title matches the current pins, or attempts to update its branch and metadata. If an in-place update fails, the workflow comments on and closes the stale PR before creating a replacement.

Priority: Not assessed

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as GitHub Actions workflow
  participant GitHub as GitHub PR
  participant Git as Git branch
  Workflow->>GitHub: Find open automation update PR
  alt PR title matches current pins
    Workflow->>Workflow: Reuse the existing PR
  else Pins differ
    Workflow->>Git: Commit and push saved flake.lock
    Workflow->>GitHub: Update PR branch and metadata
    alt In-place update fails
      Workflow->>GitHub: Comment on and close stale PR
      Workflow->>Git: Restore flake.lock and create replacement branch
      Workflow->>GitHub: Create replacement PR
    end
  else No reusable PR
    Workflow->>Git: Create branch and commit flake.lock
    Workflow->>GitHub: Create PR
  end

Possibly related PRs

developing-today/code#907: Adds the workflow and its original PR-publishing path, which this change modifies.
developing-today/code#914: Changes how the workflow handles validated PRs awaiting a privileged merge; this change adds reuse and superseding behavior for those open PRs.

Merge Risk: Moderate · up to 3c13a

Resolve stale-branch merge conflicts and unsafe replacement handling before merging. The workflow can also select an unrelated PR, miss an older update PR, or merge manually altered lock content despite a matching title.

Finishing Touches

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c13a6314f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-26T21:13:28Z

+          existing_number=$(gh pr list --state open --json number,headRefName \
+            --jq '[.[] | select(.headRefName | startswith("automation/flake-inputs-update-"))] | .[0].number // empty')


Search beyond the default page before creating a replacement PR

If the existing automation PR falls outside the first 30 open PRs returned, this lookup misses it and the publish step creates another automation PR instead of updating it. gh pr list --help documents --limit as “Maximum number of items to fetch (default 30)”; the local --jq filter only filters that fetched subset. Use a server-side search or pagination that includes older matching PRs before deciding that none exists.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-26T21:13:28Z

+            if [ "${existing_title}" = "${pr_title}" ]; then
+              # Same revs: the open PR already carries exactly this
+              # update, so publishing again would only duplicate it.
+              echo "Open automation PR #${existing_number} already carries these exact revs (${pr_title}); reusing it and skipping publish."
+              pr_number="${existing_number}"
+              pr_url="${existing_url}"


Refresh the failure-issue reference when reusing unchanged pins

If an automation PR was opened before a failure issue existed, a subsequent transient validation failure can create that issue, and a later successful run with the same pins enters this branch. Skipping publication also skips updating the PR body, so the newly generated Fixes #${EXISTING_NUMBER} reference is never attached. In the protected-main handoff or auto-merge paths, the downstream comments promise that merging this PR will close the failure issue, but it remains open after merge. Refresh the PR body even when its title already matches.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-26T21:13:28Z

+              && git checkout -f -B "${existing_branch}" "origin/${existing_branch}" \
+              && cp "$RUNNER_TEMP/new-flake.lock" flake.lock \
+              && git add flake.lock \
+              && git commit -m "${pr_title}" \


Incorporate current main before publishing onto the old branch

If main independently advances either input while the automation PR remains open, copying the newly computed lock onto the old PR branch does not update its merge base. Main and the PR then contain different changes to the same locked revision, leaving the supposedly ready update unmergeable despite its lockfile being computed and validated against current main. An isolated Git fixture using this repository's lockfile reproduced a content conflict after this checkout/copy/commit sequence. Incorporate current main into the reused branch and resolve the lockfile to the computed result before pushing, rather than leaving the PR permanently conflicted across subsequent runs.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-10-26T21:13:28Z

+          existing_number=$(gh pr list --state open --json number,headRefName \
+            --jq '[.[] | select(.headRefName | startswith("automation/flake-inputs-update-"))] | .[0].number // empty')


Restrict reused PRs to trusted automation branches

An external contributor can open a fork PR with this branch-name prefix and copy the expected update title while including arbitrary changes. This lookup selects that PR, and the matching-title path reuses it without checking its contents or provenance. Validation earlier in the job evaluated main with the computed lock, not the selected PR, yet the downstream logic attempts to merge that PR or comments that it is validated and ready for a privileged merge. The documented protected-main restrictions do not prevent that false validation handoff. Require a same-repository, workflow-owned PR before reuse; gh pr list --help exposes the isCrossRepository and headRepository JSON fields needed to distinguish fork heads.

Useful? React with 👍 / 👎.

fix(ci): supersede open flake-inputs update PR in place instead of st…

3c13a63

…acking a duplicate (#946)

dezren39 requested a review from a team as a code owner October 26, 2026 21:08

github-actions Bot assigned dezren39 Oct 26, 2026

dezren39 merged commit 23cbba8 into main Oct 26, 2026
3 of 4 checks passed

dezren39 deleted the queue/1148-946-flake-supersede branch October 26, 2026 21:13

chatgpt-codex-connector Bot reviewed Oct 26, 2026

View reviewed changes

dezren39 mentioned this pull request Oct 26, 2026

ci(flake-inputs-update): no dedupe for an already-open update PR — consecutive runs stack duplicate PRs for the same pins #946

Closed

dezren39 restored the queue/1148-946-flake-supersede branch October 27, 2026 09:34

dezren39 deleted the queue/1148-946-flake-supersede branch November 1, 2026 16:43

Navigation Menu

Repository navigation

fix(ci): supersede open flake-inputs update PR in place (#946) - #1014

fix(ci): supersede open flake-inputs update PR in place (#946)#1014
dezren39 merged 1 commit into
mainfrom
queue/1148-946-flake-supersede

dezren39 commented Oct 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading

Review failed

Sequence Diagram(s)

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		existing_number=$(gh pr list --state open --json number,headRefName \
		--jq '[.[] \| select(.headRefName \| startswith("automation/flake-inputs-update-"))] \| .[0].number // empty')

Conversation

dezren39 commented Oct 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Verification

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Sequence Diagram(s)

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Oct 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dezren39 commented Oct 26, 2026 •

edited by coderabbitai Bot

Loading

chatgpt-codex-connector Bot commented Oct 26, 2026 •

edited

Loading

coderabbitai Bot commented Oct 26, 2026 •

edited

Loading