[dezren39]

What

Fixes the merge step of the flake-inputs-update workflow, based on its first live run (run 40234037960).

That run did everything right up to the merge: it updated openchamber 54175bf5 → be39dda81 and opencode 954ff7c9 → 56590c57, validated the flake, pushed its branch, and opened PR #912 (since merged). Then it failed on two hard repository facts:

• gh pr merge --merge → "You're not authorized to push to this branch" — this repo protects main against the workflow token.
• gh pr merge --auto --merge → "Auto merge is not allowed for this repository" — auto-merge is disabled repo-wide.

There is no merge-capable token or GitHub App configured for this repo to borrow (the only Actions secret is JULES_API_KEY), and PRs here land by privileged merge — exactly what happened to #912 and to the workflow's own PR #907.

Change

• The publish step now distinguishes that authorization refusal from real errors. On refusal it comments on the update PR that the pins are validated and the PR is ready for a privileged merge, emits a ::warning:: in the run, and finishes green — the update itself succeeded, and a daily red run for a known permissions boundary would just train everyone to ignore the workflow. Any other publish error still fails the run.
• The failure-issue close-out gains the matching handoff state: if an update PR is waiting on a privileged merge, the tracking issue gets a comment naming the fixing PR, and the PR's Fixes #<n> line closes the issue when it lands.
• The failure-issue error excerpt now filters out nix's copying path lines before taking the tail, so the excerpt shows the actual error instead of fetch noise (seen in the sibling workflow's first tracking issue, where the excerpt was 80 lines of path copying).

Validation

• YAML parses; the file is prettier-clean under the repo's treefmt config (prettier --check passes).
• Behavior change is confined to the publish step's failure handling and the excerpt filter; the update, validation, PR-creation, direct-merge, auto-merge, and issue-tracking paths are unchanged.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

Summary by CodeRabbit

• Workflow Updates

  • Validated update pull requests that cannot be merged automatically due to permissions now remain open with a comment explaining that a privileged merge is needed. Related failure issues note that they will close when the pull request merges.
  • Other merge failures continue to fail the workflow.

• Documentation

  • Clarified that validated update pull requests may remain open while awaiting a privileged merge.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T21:49:49.240601Z	30a20f4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

The flake-input update workflow filters copying path lines from failure excerpts. It tries direct merge and auto-merge, then treats recognized permission errors as a successful handoff to a privileged maintainer. Related comments describe the handoff.

Changes: Flake input update workflow

Layer / File(s)	Summary
Failure excerpt filtering .github/workflows/flake-inputs-update.yml	Failure excerpts omit lines containing copying path before the workflow retains the final 80 lines and truncates the result to 5,000 characters.
Merge permission handoff .github/workflows/flake-inputs-update.yml	The workflow documents the protected-branch exception, tries direct merge and auto-merge, and treats recognized permission errors as a successful handoff. Pull request and failure-issue comments describe that handoff.

Priority: Not assessed

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant GitHubPR
  participant Maintainer
  Workflow->>GitHubPR: Attempt direct merge
  Workflow->>GitHubPR: Attempt auto-merge if direct merge fails
  alt Merge errors indicate restricted permissions
    Workflow->>GitHubPR: Comment that the validated PR awaits a privileged merge
    Maintainer->>GitHubPR: Merge the pull request
  end

Loading

Possibly related PRs

• developing-today/code#907: This PR introduced the same workflow paths for validation, pull request creation, merging, and failure-issue tracking.

Merge Risk: Low · up to 30a20

The workflow can incorrectly report a conflicted update as ready, or fail without handing off a validated update when token refusal wording differs. These are bounded automation-reporting issues; correct the handoff checks or explicitly accept manual follow-up.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}