fix(pr-gate): read current base ref for metadata checks - #5
Merged
Conversation
Sync evolver-cursor-plugin with the upstream pr-gate workflow fix from engineering-operating-system#19. The workflow still uses pull_request_target and never checks out PR-head code, but PR events now checkout the current base branch ref instead of the event base SHA so legacy PR body edits can resolve after the check becomes required. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Touches hot-path: no
Phase: fix
Risk vector: forward
Summary
Re-syncs
evolver-cursor-plugin's installedpr metadata policyworkflow with the upstream Engineering Operating System fix. The workflow still runs onpull_request_target, keeps the token read-only, and validates the base-branch PR template/body contract; it now checks out the current base branch ref instead of the event's stale base SHA so old PR body edits can resolve after the gate becomes required.Scope and cuts
Nothing cut. The requested outcome for this repository is the downstream workflow sync needed before
pr metadata policycan safely become a required branch-protection check. This PR changes only the installed workflow file; it does not enable branch protection by itself. Required-check promotion happens only after this lands and open PR checks resolve.Module boundary
Repository governance only:
.github/workflows/pr-metadata-policy.yml. No product code, runtime path, schema, deployment, package manifest, or PR template is touched.Alternative considered
Leave this repo on the stale
base.shaworkflow and handle old PRs by rebasing or pushing every branch. Rejected because the workflow explicitly listens toedited; a PR-body edit must be enough to resolve the check, and legacy branches may not have active owners. Switching topull_requestwas also rejected because it would let a PR change the template it is checked against.Validation
Body validated against this repository's PR metadata validator before PR creation. Workflow content compared against the fixed upstream canonical workflow. The upstream source PR passed
tests.test_pr_gate,tests.test_bootstrap_repo,scripts/validate_scaffold.py, and sample workflow byte-identity checks.Rollback / recovery
Revert this PR to restore the previous installed workflow. If branch protection has already been changed, remove
pr metadata policyfrom required checks before reverting, or legacy PRs can return to the stale-base-SHA failure mode.🤖 Generated with Claude Code