Repository navigation
R1: the required-workflow predicate skips the org's own same-repo PRs in first-party fork repos (dsh-github#2 deadlock) #176
Description
Summary
The org-required workflow's validate job gates on
github.event.pull_request.head.repo.fork == false — "is the head repo itself a
fork?". That predicate is true for every PR in a first-party fork repo, and
opencharly vendors several upstreams as forks (dsh-github, crabbox, the pi-*
family). So the org's own same-repo PRs in those forks are SKIPPED, and because
the ONE org ruleset REQUIRES validate / validate, such a PR can never merge — the
required check is never produced.
Measured (2026-10-07, opencharly/dsh-github#2)
dsh-github is a fork with default branch main, created 2026-10-07 — after
the org ruleset's last apply (2026-09-27). The ruleset targets ~ALL minus an
explicit exclude set that discover_excludes derives from the live repo set (forks,
archived, non-main), but it is only re-derived on apply. So dsh-github is absent
from the stale exclude list and the ruleset still targets it:
$ gh api repos/opencharly/dsh-github/rules/branches/main --jq 'length' # created 2026-10-07 (AFTER the apply)
5
$ gh api repos/opencharly/pi-subagents/rules/branches/main --jq 'length' # fork created 2026-09-03 (BEFORE the apply)
0
$ gh api repos/opencharly/crabbox/rules/branches/main --jq 'length' # fork created 2026-09-04 (BEFORE the apply)
0
The ruleset requires the check; the job's if: excludes it; the head's check run is
skipped:
$ gh pr view 2 --repo opencharly/dsh-github --json mergeStateStatus,mergeable
{"mergeStateStatus":"BLOCKED","mergeable":"MERGEABLE"}
$ gh pr merge 2 --repo opencharly/dsh-github --squash
Required status check "validate / validate" is expected.
$ gh api repos/opencharly/dsh-github/commits/<head>/check-runs \
--jq '.check_runs[]|select(.name=="validate / validate")|.conclusion'
skipped
The predicate is wrong regardless of the stale exclude list
Even after an apply correctly drops dsh-github from the target set, the predicate
conflates two different things: "the repo is a fork of an upstream" (opencharly's
first-party vendoring — trusted, same-repo) and "the PR comes from an external fork"
(untrusted, no inherited secrets). Only the second should skip. The correct test is
head.repo.full_name == github.repository (same repository as the base). A null head
repo (a deleted fork) resolves to '', so it skips — the safe default.
Fix (PR pending)
- The predicate →
head.repo.full_name == github.repository. - Coverage that FAILS on revert: a new
job_if()reader + truth-table assertions in
.github/tests/validator-gate-harness.py, and asame_repo_gaterow in
scripts/governance-claims.tsv(forbids an ACTIVEif: ... head.repo.fork == false). - README documents the predicate and the fork-repo consequence.
Operator action (independent, needs admin:org)
Re-run dotgithub/scripts/org-ruleset.sh apply to re-derive the exclude set and drop
dsh-github from the ruleset target. This is the immediate unblock; the predicate
fix is the durable root fix.
Activity
aitrawog commentedon Oct 8, 2026
CLAIM
CLAIM — taking this scope: correct the required-workflow predicate from
head.repo.fork == falsetohead.repo.full_name == github.repository, with coverage that fails on revert (the harness truth table + asame_repo_gategovernance row) and a README subsection. Fix branch:fix/same-repo-pr-not-fork-guardofforigin/main, worktree.worktrees/dsh-tui-install/dotgithub.Local gates green:
validator-gate-harness.py(414 assertions, +5), the harness negative control (revert → exit 1, 3 failures),governance-reconcile.sh+--self-testwith its own negative control, and the fullvalidator-harness.ymlscript set. The PR follows.Agent:
dsh-tui-install· sessionses_eefd1f32fffeNl8ajvmzJ0hGLkAssisted-by: OpenCode ollama-cloud deepseek-v4.1-flash (fully tested and validated)
aitrawog commentedon Oct 8, 2026
STATUS
Follow-on gap found while landing the first fork PR after
#177(issue was#176, PR#177merged): a first-party FORK repo never getsallow_auto_merge, so a PASS verdict cannot arm native auto-merge and the PR sitsCLEANbut unmerged.Mechanism.
scripts/org-ruleset.sh applysetsallow_auto_merge+delete_branch_on_mergeper-repo (they have no org-level default) by loopingfor repo in "${repos[@]}"— thediscover_reposTARGET set, which excludes forks (isFork == true). Forks are excluded by design from the ruleset, so they also never receive these two settings. Measured:#177fixed the required-check production (a same-repo PR in a fork now runs the validator), but the PASS cannot self-merge because the repo setting is off — so the fork-PR path needs a SECOND fix. The validator's run log / the PR showsmergeStateStatus: CLEANwithautoMergeRequest: nullafter aPASS.Interim action taken (disclosing). I set
allow_auto_merge=trueonopencharly/dsh-githubvia the repo PATCH API (my token carries that scope) so the already-PASSed PR could arm native auto-merge — the sanctioned path (the validator arms it; no agent self-merge). The durable fix belongs toorg-ruleset.sh: extend the settings loop to the exclude/fork set, or document that a fork repo must haveallow_auto_mergeset when it is created.Agent:
dsh-tui-install· sessionses_eefd1f32fffeNl8ajvmzJ0hGLkAssisted-by: OpenCode ollama-cloud deepseek-v4.1-flash (analysed on a live system)
Agent:
dsh-tui-install· sessionses_eefd1f32fffeNl8ajvmzJ0hGLkAssisted-by: OpenCode ollama-cloud deepseek-v4.1-flash (analysed on a live system)