From e46677bf754707271b080f9aef78a6d5d0bfac4a Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Mon, 28 Sep 2026 10:57:23 -0500 Subject: [PATCH 1/2] auto-approve PRs from notecard-schema --- .github/workflows/update-notecard-schema.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-notecard-schema.yml b/.github/workflows/update-notecard-schema.yml index 88c0baf..99eac28 100644 --- a/.github/workflows/update-notecard-schema.yml +++ b/.github/workflows/update-notecard-schema.yml @@ -145,7 +145,10 @@ jobs: # to approve at all, so main's 1-review rule still needs a human -- unless # that rule is moved to a ruleset that this App bypasses. - name: Enable auto-merge - if: ${{ steps.pr.outputs.branch != '' && steps.changes.outputs.automerge_safe == 'true' && steps.app-token.outputs.token != '' }} + if: + ${{ steps.pr.outputs.branch != '' && + steps.changes.outputs.automerge_safe == 'true' && + steps.app-token.outputs.token != '' }} env: GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_BRANCH: ${{ steps.pr.outputs.branch }} @@ -159,6 +162,15 @@ jobs: fi - name: Report skipped auto-merge - if: ${{ steps.changes.outputs.has_changes == 'true' && steps.changes.outputs.automerge_safe != 'true' }} + if: + ${{ steps.changes.outputs.has_changes == 'true' && + steps.changes.outputs.automerge_safe != 'true' }} run: | echo "::notice::PR opened but auto-merge was skipped: the generator changed paths outside notecard/. Review and merge by hand." + + - name: Approve (as github-actions, not the App that opened it) + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: + gh pr review "$PR_BRANCH" --approve -b "Automated schema sync; CI + gates the merge." From 8b4435738b4c77fe73113cd960e567343c8f7d9a Mon Sep 17 00:00:00 2001 From: Rob Lauer Date: Mon, 28 Sep 2026 11:00:58 -0500 Subject: [PATCH 2/2] don't let Coveralls failures gate merges The publish step runs inside the build job, so any Coveralls error fails the build: fail-fast cancels the rest of the matrix and the required `ci-gate` goes red. A Coveralls 500 did exactly that on 2026-09-28 with all 419 tests passing, and a 422 did it on #185. The `coverage/coveralls` status was never a required check, but the publish step's exit code effectively made it one. continue-on-error keeps coverage reporting informational. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/python-ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml index b7b77d0..d18ebb1 100644 --- a/.github/workflows/python-ci.yml +++ b/.github/workflows/python-ci.yml @@ -77,10 +77,15 @@ jobs: # as the same job for the same commit and Coveralls 422s all but one -- # intermittently failing the build (PR #185). Coverage is the same on every # version, so publishing from one is no loss. + # + # continue-on-error: coverage reporting must never gate a merge. Without + # it a Coveralls outage (a 500 on 2026-09-28) fails this job, fail-fast + # cancels the rest of the matrix, and the required `ci-gate` goes red. - name: Publish to Coveralls env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} if: ${{ inputs.coveralls && matrix.python-version == '3.12' }} + continue-on-error: true run: | pipenv run coveralls --service=github