feat(github): route all installation writes through a dry-run-aware client - #1258
Merged
Conversation
…lient Dry-run only gated the merge/close ACTIONS; the review-surface publishing (gate check-run, sticky comment, status label in maybePublishPrPublicSurface) checked no mode, so an agent_dry_run / pause / global-freeze still wrote to GitHub — re-enabling a repo in "dry-run" still refreshed comments + labels + check-runs on every open PR. That is not a true dry-run. Make "no GitHub mutation unless live" a STRUCTURAL invariant instead of a per-call convention: - New src/github/client.ts: makeInstallationOctokit(env, token, mode) is the single place an installation Octokit is built. When mode !== "live" a request hook suppresses every state-changing verb (POST/PATCH/PUT/DELETE) — auditing the intent (github.write.suppressed) and returning a route-shaped synthetic response — so no write reaches GitHub. GET/HEAD always pass (reads + the create-vs-update / dedup probes). resolveRepoActionMode mirrors the executor (env brake OR DB freeze OR per-repo pause/dry-run), resolved once per review. - Every new Octokit in src/github/** (app/comments/labels/pr-actions) now routes through the factory; the surface helpers thread the repo mode, the already action-gated pr-action helpers default to "live" to avoid double-deny. The helpers also inherit a shared 12s request timeout they previously lacked. - maybePublishPrPublicSurface resolves the mode once and threads it into the check-run / comment / label writes, so a dry-run computes + returns the gate verdict for the disposition logic but publishes nothing. - test/unit/no-direct-octokit.test.ts forbids a raw `new Octokit` anywhere else in src/github/**, so the invariant cannot rot. Maintainer @gittensory commands keep writing (a human actor is not the agent's autonomy). Three raw-fetch writers (upstream drift issues, contributor-issue drafts, end-user fork drafting) use non-installation tokens outside this factory and are a documented follow-up.
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1258 +/- ##
==========================================
+ Coverage 95.01% 95.02% +0.01%
==========================================
Files 176 177 +1
Lines 19849 19880 +31
Branches 7143 7162 +19
==========================================
+ Hits 18859 18891 +32
+ Misses 396 395 -1
Partials 594 594
🚀 New features to boost your workflow:
|
8 tasks
JSONbored
added a commit
that referenced
this pull request
Jun 24, 2026
…reeze (#1263) The dry-run client chokepoint (#1258) suppresses installation-Octokit writes under a non-live mode, but two agent-initiated writers use a raw PAT outside it and ignored the operator brake: - fileUpstreamDriftIssues (upstream/ruleset.ts) POSTed/PATCHed GitHub issues every cron tick, gated only by GITTENSORY_AUTO_FILE_DRIFT_ISSUES — neither the env brake nor the DB freeze stopped it. - generateContributorIssueDrafts (services/contributor-issue-draft.ts) filed issues whenever a caller passed {dryRun:false}, with no relation to the agent action mode. Both now consult the global agent state: fileUpstreamDriftIssues returns early with status "paused", and the contributor-draft dryRun flag is OR-ed with the env brake / DB freeze so a paused/frozen agent never writes. The end-user fork drafting (services/draft.ts) is intentionally left alone — it acts under the user's own OAuth token, a different actor class than the autonomous agent. Regression tests cover both the env-brake and DB-freeze arms for each writer, asserting no POST/PATCH reaches the network.
JSONbored
added a commit
that referenced
this pull request
Jun 25, 2026
…the per-PR job (#1294) The in-flight guard (fanOutAgentRegateSweepJobs) decides "is a sweep still draining for this repo?" from getLatestRegatedAt — the most recent last_regated_at across the repo's open PRs. But that marker was only stamped by markPullRequestRegated INSIDE the per-PR handler, AFTER the heavy re-review (staggered up to 600s, and under the rate-headroom defer it re-queues without stamping at all). So on a large repo the stamp lagged minutes — or never landed — behind the sweep, the guard never saw it, and every ~2-min cron re-armed another full sweep that fanned out 25 more per-PR jobs. A metagraphed dry-run reproduced it: 6 overlapping sweeps in ~4 min, ~150 jobs, last_regated_at never advancing past 0. (All inert — dry-run suppressed every GitHub write — so it surfaced safely with zero dead-letters.) Stamp the convergence marker for EVERY candidate at DISPATCH (markPullRequestsRegated, one batch D1 write in sweepRepoRegate) instead of inside the per-PR job. Now getLatestRegatedAt reflects the sweep immediately, the guard engages on the next cron tick, and convergence advances regardless of whether a per-PR re-review defers, backlogs, or fails (the next sweep after the freshness window re-claims any PR whose re-review did not land). The per-PR job only does the heavy re-review now. The marker is a plain D1 write, never the #1258 chokepoint, so dry-run stays inert.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dry_runonly gated the merge/close actions. The review-surface publishing — the gate check-run, the sticky comment, and the status label inmaybePublishPrPublicSurface— checked no mode, so anagent_dry_run/ pause / global-freeze repo still wrote to GitHub. Re-enabling a repo in "dry-run" would still refresh comments + labels + check-runs on every open PR. That is not a true dry-run.This makes "no GitHub mutation unless
live" a structural invariant rather than a per-call convention.How
src/github/client.ts—makeInstallationOctokit(env, token, mode)is the single place an installation Octokit is built. Whenmode !== "live", a request hook suppresses every state-changing verb (POST/PATCH/PUT/DELETE) — auditing the intent (github.write.suppressed) and returning a route-shaped synthetic response (check-run/comment id-1, merge{merged,sha:null}, etc., so every response reader survives) — so no write reaches GitHub. GET/HEAD always pass (reads + the load-bearing create-vs-update / dedup probes).resolveRepoActionModemirrors the executor exactly (env brake OR DB freeze OR per-repo pause/dry-run), resolved once per review.new Octokitinsrc/github/**(app/comments/labels/pr-actions) now routes through the factory. Surface helpers thread the repo mode; the already-action-gatedpr-actionhelpers default to"live"to avoid double-deny. As a bonus, the comment/label/pr-action helpers inherit a shared 12 s request timeout they previously lacked.maybePublishPrPublicSurfaceresolves the mode once and threads it into the check-run / comment / label writes — so a dry-run still computes and returns the gate verdict for the disposition logic, but publishes nothing.test/unit/no-direct-octokit.test.tsforbids a rawnew Octokitanywhere else insrc/github/**, so the invariant cannot silently rot.Scope / boundaries (deliberate)
@gittensorycommands keep writing — a human actor running gate-override is not the agent's autonomy and shouldn't silently no-op under the agent's dry-run.fetch()writers use non-installation tokens outside this factory and are not covered here:fileUpstreamDriftIssues(most important — currently ignores the pause entirely),createGitHubContributorIssue, and the end-user fork drafting. They need a parallel mode guard — filed as the immediate follow-up. Until then the invariant holds for installation-token Octokit writes (which is the whole review surface).Scope
Validation
npm run test:ci— full gate greennpm audit --audit-level=moderate— 0 vulnerabilitiesgithub-client.test.ts: live passes through; dry_run/paused suppress writes (no fetch) + audit + synthetic shape per route; GET passes;resolveRepoActionModecovers env-brake / DB-freeze / pause / dry-run / nullish;timeoutFetchboth arms. Structural guard test added.v8 ignore— its mode-threaded behavior is exercised by its inner-catch twin)Safety
site//CNAME/lovable