ci(stlc): gate the fork heal on staging CI passing on the merge

A clean text merge can still fail to build when the two sides combine
(a rename on one side, a new call to the old name on the other), and the
heal pushed that merge to production main before any CI ran on it.

The heal now force-pushes the merge commit to a stlc-fork-heal branch on
staging, which triggers the existing CI workflow, waits for that CI run
on the exact SHA (30 min cap), and pushes to both mains only on success.
A failure, cancellation, or timeout pushes nothing and fails with the
CI link and the commits on each side; the temporary branch is deleted
either way. Promote gains actions: read and passes github.token as
GH_TOKEN for the run lookup.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: tode-rl

.github/scripts/stlc-heal-fork.sh

@@ -1,11 +1,17 @@
 #!/usr/bin/env bash
 # Heals a staging/production trunk fork with a merge commit, only when the
-# trunks merge cleanly; otherwise explains the fork and fails.
+# trunks merge cleanly and staging CI passes on that merge; otherwise explains
+# the fork and fails.
 # Expects origin/main = staging main and production/main = production main,
-# plus GITHUB_REPOSITORY (staging), PRODUCTION_REPO and PRODUCTION_REPO_TOKEN.
+# plus GITHUB_REPOSITORY (staging), PRODUCTION_REPO, PRODUCTION_REPO_TOKEN, and
+# GH_TOKEN able to read staging's Actions runs.
 set -euo pipefail
 
 HINT="$(dirname "$0")/stlc-fork-hint.sh"
+HEAL_BRANCH=stlc-fork-heal
+CI_WORKFLOW=.github/workflows/ci.yml
+CI_TIMEOUT=${STLC_HEAL_CI_TIMEOUT:-1800}
+POLL=${STLC_HEAL_POLL:-15}
 
 # One trunk ahead of the other is a fast-forward, not a fork.
 if git merge-base --is-ancestor origin/main production/main ||
@@ -39,12 +45,56 @@ MERGE=$(
 
 git remote set-url production "https://x-access-token:${PRODUCTION_REPO_TOKEN}@github.com/${PRODUCTION_REPO}.git"
 git remote set-url origin "https://x-access-token:${PRODUCTION_REPO_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+push() { git -c "http.https://github.com/.extraheader=" push "$@"; }
+
+# Nothing reaches main until staging CI passes on this exact merge: a clean text
+# merge can still fail to build. CI runs on any staging branch push; the branch
+# only triggers it.
+push --force origin "$MERGE:refs/heads/$HEAL_BRANCH"
+trap 'push -q origin --delete "$HEAL_BRANCH" || true' EXIT
+
+blocked() {
+  {
+    echo "### Staging and production main have forked; heal blocked by CI"
+    echo
+    echo "They merge cleanly as text, but $1, so nothing was pushed to main. Fix the combination on either trunk (or push a fixed merge by hand); the next back-sync poll retries the heal."
+    echo
+    echo "CI run: ${CI_URL:-none found}"
+    echo
+    echo "**Only on staging:**"
+    echo '```'
+    echo "$STAGING_ONLY"
+    echo '```'
+    echo "**Only on production:**"
+    echo '```'
+    echo "$PRODUCTION_ONLY"
+    echo '```'
+  } >> "${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+  echo "::error title=Fork heal blocked::$1 on clean merge commit ${MERGE}; nothing was pushed to main. CI run: ${CI_URL:-none found}"
+  exit 1
+}
+
+deadline=$((SECONDS + CI_TIMEOUT))
+STATUS="" CONCLUSION="" CI_URL=""
+while :; do
+  # A failed lookup reads as "not finished yet" and is retried until the deadline.
+  read -r STATUS CONCLUSION CI_URL < <(
+    gh api "repos/${GITHUB_REPOSITORY}/actions/runs?head_sha=${MERGE}&event=push" \
+      --jq "[.workflow_runs[] | select(.path | startswith(\"${CI_WORKFLOW}\"))][0] | \"\(.status) \(.conclusion) \(.html_url)\""
+  ) || true
+  [ "$CI_URL" = null ] && CI_URL=""
+  [ "$STATUS" = completed ] && break
+  [ "$SECONDS" -ge "$deadline" ] && blocked "staging CI did not finish within ${CI_TIMEOUT}s"
+  sleep "$POLL"
+done
+
+[ "$CONCLUSION" = success ] || blocked "staging CI concluded ${CONCLUSION}"
 
 # Both pushes are fast-forwards (MERGE descends from each tip), so a trunk that
 # moved since the fetch rejects the push and the next scheduled run retries.
 # Production first: if staging then moves, the next run sees a fresh fork and heals it.
-git -c "http.https://github.com/.extraheader=" push production "$MERGE:refs/heads/main"
-git -c "http.https://github.com/.extraheader=" push origin "$MERGE:refs/heads/main"
+push production "$MERGE:refs/heads/main"
+push origin "$MERGE:refs/heads/main"
 
 SHORT=$(git rev-parse --short "$MERGE")
 {
@@ -60,6 +110,6 @@ SHORT=$(git rev-parse --short "$MERGE")
   echo '```'
   echo "$PRODUCTION_ONLY"
   echo '```'
-  echo "The combination was not tested before it reached production; staging CI runs on the push."
+  echo "Staging CI passed on this exact commit before it was pushed: ${CI_URL}"
 } >> "${GITHUB_STEP_SUMMARY:-/dev/stdout}"
 echo "::warning title=Trunk fork healed::pushed clean merge commit ${SHORT} to staging and production main. See the job summary for the commits it joined."

.github/workflows/stlc-promote.yml

@@ -7,8 +7,8 @@ name: Promote SDKs
 # staging main, because any staging-only commit (stlc build or not) forks the trunks
 # against the next production merge; the daily schedule is a backstop and
 # workflow_dispatch an eager promote (back-sync dispatches it on a fork). A fork
-# that merges cleanly is healed with a merge commit on both trunks (the only
-# non-linear history this writes); a conflicting fork fails for a person to resolve.
+# that merges cleanly and passes staging CI is healed with a merge commit on both
+# trunks (the only non-linear history this writes); anything else fails for a person.
 # Every run is a safe no-op when there's nothing to promote.
 on:
   push:
@@ -20,6 +20,7 @@ on:
 
 permissions:
   contents: read
+  actions: read
 
 jobs:
   promote:
@@ -70,6 +71,7 @@ jobs:
         if: steps.diff.outputs.synced == 'false'
         env:
           PRODUCTION_REPO_TOKEN: ${{ secrets.PRODUCTION_REPO_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           # Production not an ancestor of staging means the trunks have forked
           # (production advanced without a back-sync) and FF is unsafe: heal with a