From 3dcf0ce021c4640bc6daa33e4127a91b3da6c4ee Mon Sep 17 00:00:00 2001 From: Barcode Betty Date: Wed, 3 Jun 2026 21:34:18 +0000 Subject: [PATCH] ci: treat infra PR approvals gate as success in deploy jobs (CAR-1212) Per the spec for CAR-1212 (CAR-1195 follow-up): - deploy-dev and deploy-uat now request cs_savannah as a reviewer on the cartsnitch/infra PR (best-effort, log on non-2xx, never fail the job). - After the merge attempt, classify the response: * .merged == true -> success notice * 'Does not have enough approvals' -> ::notice:: + exit 0 (GitOps approval gate, not a failure; the PR is correctly opened and surfaces in the CTO queue) * anything else -> keep the existing ::error:: and exit 1 (genuine unexpected failure) This unblocks the deploy jobs that were hard-failing on the branch-protection approvals requirement, which a CI bot cannot self-satisfy. The CTO (cs_savannah) already backstop-approves+merges these infra PRs by hand (e.g. #321, #322). - 'No image changes to deploy' early-exit preserved. - Still uses secrets.CI_GITEA_TOKEN for the PR/reviewer/merge API calls. - No git push origin main: only the API path is used. Refs CAR-1195, CAR-1194. Co-Authored-By: Paperclip --- .gitea/workflows/ci.yml | 44 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 40 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 27e95eb..7efee44 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -567,18 +567,36 @@ jobs: exit 1 fi echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})" + # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort: + # log on non-2xx but never fail the job for this. + REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \ + -H "Authorization: token ${CI_GITEA_TOKEN}" \ + -H "Content-Type: application/json" \ + -d '{"reviewers":["cs_savannah"]}' \ + "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers") + if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then + echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing" + fi MERGE_RESP=$(curl -sS -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"Do":"merge","delete_branch_after_merge":true}' \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge") MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false') - if [ "$MERGED" != "true" ]; then + if [ "$MERGED" = "true" ]; then + echo "PR #${PR_NUM} merged into cartsnitch/infra main" + elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then + # GitOps approval gate: the PR is correctly opened and surfaces in + # the CTO queue via the reviewers request above. Treat as success + # (exit 0) so the deploy job does not hard-fail on the approvals + # requirement that only a human maintainer can satisfy. + echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure" + exit 0 + else echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP" echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge." exit 1 fi - echo "PR #${PR_NUM} merged into cartsnitch/infra main" deploy-uat: runs-on: ubuntu-latest @@ -693,15 +711,33 @@ jobs: exit 1 fi echo "Opened cartsnitch/infra PR #${PR_NUM} (head=${BRANCH})" + # Request CTO (cs_savannah) review as the GitOps hand-off. Best-effort: + # log on non-2xx but never fail the job for this. + REVIEW_HTTP=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \ + -H "Authorization: token ${CI_GITEA_TOKEN}" \ + -H "Content-Type: application/json" \ + -d '{"reviewers":["cs_savannah"]}' \ + "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/requested_reviewers") + if [ "${REVIEW_HTTP}" -lt 200 ] || [ "${REVIEW_HTTP}" -ge 300 ]; then + echo "::notice::Failed to request reviewers for cartsnitch/infra PR #${PR_NUM} (HTTP ${REVIEW_HTTP}); continuing" + fi MERGE_RESP=$(curl -sS -X POST \ -H "Authorization: token ${CI_GITEA_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"Do":"merge","delete_branch_after_merge":true}' \ "https://git.farh.net/api/v1/repos/cartsnitch/infra/pulls/${PR_NUM}/merge") MERGED=$(echo "$MERGE_RESP" | jq -r '.merged // false') - if [ "$MERGED" != "true" ]; then + if [ "$MERGED" = "true" ]; then + echo "PR #${PR_NUM} merged into cartsnitch/infra main" + elif echo "$MERGE_RESP" | grep -qi 'does not have enough approvals'; then + # GitOps approval gate: the PR is correctly opened and surfaces in + # the CTO queue via the reviewers request above. Treat as success + # (exit 0) so the deploy job does not hard-fail on the approvals + # requirement that only a human maintainer can satisfy. + echo "::notice::infra PR #${PR_NUM} opened and awaiting CTO (cs_savannah) approve+merge — GitOps approval gate, not a failure" + exit 0 + else echo "::error::Auto-merge of cartsnitch/infra PR #${PR_NUM} failed: $MERGE_RESP" echo "::error::Reassign to cs_savannah (authorized merger for cartsnitch/infra main) for backstop merge." exit 1 fi - echo "PR #${PR_NUM} merged into cartsnitch/infra main"