lint.yml fails on every pull_request run while passing on main #773

New issue

Open

opened 2026-08-09 06:33:04 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-09 06:33:04 +00:00

Owner

Summary

.forgejo/workflows/lint.yml fails on every pull_request run and passes on every push run to main, across unrelated diffs. The red check on a PR currently carries no information about that PR.

Evidence

run	ref	commit	result
2228	main		success
2232	main	`a5ad735b`	success
2234	#769	`362b8b76`	failure
2236	#770	`2072a8ae`	failure
2240	main	`23d887fe`	success
2243	#772	`39e56cff`	failure

Three PRs with entirely different diffs fail identically. a5ad735b is the exact base commit #769 and #770 branched from and it passes on the push path, so this is not inherited from main.

#770 is the strongest single data point: it failed as a PR at 2072a8ae, was merged anyway, and the identical tree passed on main at 23d887fe one run later. Same content, same workflow, different trigger, opposite result.

trufflehog.yml passes on all of the same PR refs, so it is not the runner or the gate image in general.

Suspect

lint.yml has exactly one pull_request-only step, which is the only structural difference between the two paths:

- name: Attach pull-request merge commit for Ward
  if: ${{ github.event_name == 'pull_request' }}
  env:
    WARD_CI_BASE_REF: ${{ github.base_ref }}
    WARD_CI_PR_NUMBER: ${{ github.event.pull_request.number }}
  run: |
    set -euo pipefail
    git switch -c "ci/pr-$WARD_CI_PR_NUMBER"
    git branch --set-upstream-to="origin/$WARD_CI_BASE_REF"

Everything after it (uv sync, ward exec ansible-sync-test, ward exec pre-commit) is shared with the passing push path. pre-commit run --all-files passes locally on each of these branches, which is consistent with the failure being in this step or in what it does to Ward's view of the branch rather than in the linted content.

Unverified. This needs the actual job log.

Blocker on diagnosis

I could not retrieve the job log through the guarded API. Both endpoints 404 for every id form tried, index_in_repo and internal id alike:

GET /repos/{owner}/{repo}/actions/runs/{run_id}/logs
GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs

aosguard ops forgejo action-run get works and resolves run_id against the internal id, so the id space is inconsistent between these endpoints on this Forgejo version. That is worth a look on its own, since it blocks read-only CI diagnosis generally.

Direct run URL for a human: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/2243

Why it matters

Every PR against this repo shows a red required-looking check that means nothing, so a real lint regression on a PR would be indistinguishable from the current noise. #770 was merged over this failure already.

Next step

Needs an operator or director run to read the failing job log and confirm whether the git switch step or a downstream Ward invocation is the cause. Labelling this interactive: the diagnosis needs live CI state, and pushing commits to probe it would be CI debugging by trial.

## Summary `.forgejo/workflows/lint.yml` fails on **every** `pull_request` run and passes on **every** `push` run to `main`, across unrelated diffs. The red check on a PR currently carries no information about that PR. ## Evidence | run | ref | commit | result | |---|---|---|---| | 2228 | main | | success | | 2232 | main | `a5ad735b` | success | | 2234 | #769 | `362b8b76` | **failure** | | 2236 | #770 | `2072a8ae` | **failure** | | 2240 | main | `23d887fe` | success | | 2243 | #772 | `39e56cff` | **failure** | Three PRs with entirely different diffs fail identically. `a5ad735b` is the exact base commit #769 and #770 branched from and it passes on the push path, so this is not inherited from `main`. `#770` is the strongest single data point: it failed as a PR at `2072a8ae`, was merged anyway, and the identical tree passed on `main` at `23d887fe` one run later. Same content, same workflow, different trigger, opposite result. `trufflehog.yml` passes on all of the same PR refs, so it is not the runner or the gate image in general. ## Suspect `lint.yml` has exactly one `pull_request`-only step, which is the only structural difference between the two paths: ```yaml - name: Attach pull-request merge commit for Ward if: ${{ github.event_name == 'pull_request' }} env: WARD_CI_BASE_REF: ${{ github.base_ref }} WARD_CI_PR_NUMBER: ${{ github.event.pull_request.number }} run: | set -euo pipefail git switch -c "ci/pr-$WARD_CI_PR_NUMBER" git branch --set-upstream-to="origin/$WARD_CI_BASE_REF" ``` Everything after it (`uv sync`, `ward exec ansible-sync-test`, `ward exec pre-commit`) is shared with the passing push path. `pre-commit run --all-files` passes locally on each of these branches, which is consistent with the failure being in this step or in what it does to Ward's view of the branch rather than in the linted content. Unverified. This needs the actual job log. ## Blocker on diagnosis I could not retrieve the job log through the guarded API. Both endpoints 404 for every id form tried, `index_in_repo` and internal `id` alike: - `GET /repos/{owner}/{repo}/actions/runs/{run_id}/logs` - `GET /repos/{owner}/{repo}/actions/runs/{run_id}/jobs` `aosguard ops forgejo action-run get` works and resolves `run_id` against the internal id, so the id space is inconsistent between these endpoints on this Forgejo version. That is worth a look on its own, since it blocks read-only CI diagnosis generally. Direct run URL for a human: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/2243 ## Why it matters Every PR against this repo shows a red required-looking check that means nothing, so a real lint regression on a PR would be indistinguishable from the current noise. #770 was merged over this failure already. ## Next step Needs an operator or director run to read the failing job log and confirm whether the `git switch` step or a downstream Ward invocation is the cause. Labelling this `interactive`: the diagnosis needs live CI state, and pushing commits to probe it would be CI debugging by trial.

coilyco-ops added the

role/sysadmin

priority

labels

2026-08-25 08:02:15 +00:00

coilyco-ops added the

autonomy

headless

label

2026-08-25 09:30:17 +00:00

coilyco-ops added this to the CI and repo hygiene milestone

2026-08-29 06:10:33 +00:00