fix(currency): unblock CVE fixes + guard agent-fix against stale commits - #6494
Open
Eren-Jeager123 wants to merge 1 commit into
Open
fix(currency): unblock CVE fixes + guard agent-fix against stale commits#6494Eren-Jeager123 wants to merge 1 commit into
Eren-Jeager123 wants to merge 1 commit into
Conversation
…t-fix against stale commits Merge Conditions ignored all ecr-vulnerability-scan checks, so CVE failures never triggered the Currency Fix Agent. Keep scans non-blocking except for vllm/sglang *-ubuntu configs, which the agent already tracks. Add a guard to the Currency Fix Agent that skips when the failed run's commit is stale (branch moved on), the branch is gone, or the PR carries a stop-agent-fix label — preventing fixes layered on top of newer human commits.
Eren-Jeager123
added
the
stop-agent-fix
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The Day0 currency Currency Fix Agent (
_prcheck.currency-fix.yml) stopped fixing CVEs, and could push fixes on top of stale commits.1. CVEs no longer get fixed
Commit
66c2d54aadded/ecr-vulnerability-scan$/toignoredPatternsin Merge Conditions, making every ECR scan non-blocking. The Currency Fix Agent only triggers when Merge Conditions concludesfailure, so:2. Agent acts on stale commits
workflow_runcan fire for an older Merge Conditions run. The agent checks out the branch tip but reasons off the old run's logs, then pushes an[agent-fix]commit on top of whatever was pushed since — e.g. a manual human fix.Changes
_prcheck.merge-conditions.yml— ECR scans stay non-blocking exceptvllm/*-ubuntuandsglang/*-ubuntuconfigs, which now block merge (exactly what the agent already tracks:PR - vLLM Ubuntu | PR - SGLang Ubuntu). TheblockingScanPatternregex was validated against real check-run names — it blocks the three Ubuntu scans and still ignores amzn2023 / vllm-omni / huggingface-vllm / pytorch scans._prcheck.currency-fix.yml— Added a Guard step (runs before checkout, via GitHub API) that skips the job when:head_shano longer matches the branch tip — a newer run will handle the latest commit.stop-agent-fixlabel.The
WaitandFind failed workflowssteps are gated on the guard; all downstream steps already key offhas_failures, which stays empty when the guard skips, so the chain cascades off cleanly. Addedpull-requests: readpermission for the label lookup.Manual override
Add the
stop-agent-fixlabel to any auto-update PR to stop the agent from pushing commits to it. (Label created in the repo.)Testing
blockingScanPatternverified against real check-run names from a merged currency PR ([Auto-Update] vllm 0.26.0 #6446).