Repository navigation
ci: close the issues a resolver-merged PR names (close-issues job) - #922
Conversation
GitHub does not act on closing keywords when the merge is made with the workflow's GITHUB_TOKEN, which is how the resolver merges (PUT /pulls/N/merge). All 8 resolver merges with a closing keyword left their issue open (#801 after #908; #680, #682, #683, #685, #693, #699, #714 were closed by hand on 2026-11-05), while the merges by cdeust closed theirs within minutes. A close-issues job, after a successful resolve and outside the test chain, reads the PR's closingIssuesReferences (GitHub's own parse of the keywords), comments and closes each open one with state_reason completed. It holds issues: write and pull-requests: read only; the after-merge caller grants issues: write, and the route and profile contracts name the new permission and job.
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude finished @cdeust's task in 2m 26s —— View job PR #922 review (1 of 3)
Blockers:
There are also 3 notes, no action needed before merge: the workflow file is generated by Verdict: block |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5b9860264b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if issue["state"] != "OPEN": | ||
| print(f"#{issue['number']} already {issue['state'].lower()}") | ||
| continue | ||
| path = f"{API}/repos/{repository}/issues/{issue['number']}" |
There was a problem hiding this comment.
When a merged PR references an open issue in another repository, this constructs the write URL using GITHUB_REPOSITORY rather than the linked issue's repository. GitHub supports cross-repository closing references such as Fixes owner/other-repo#100 (documentation). Because the query only retrieves number and state, the job would comment on and close this repository's unrelated issue #100 instead, if that number exists locally. Retrieve the issue's repository identity and skip references outside the current repository before performing any writes.
Useful? React with 👍 / 👎.
Review 1 of 3: PR #922 (
|
|
CI autopilot : cette branche a 3 commits de retard sur Generated by Claude Code |
…job) Review 1 blockers: a node from another repository (Closes other/repo#12) would close the issue with the same number here, so nodes are filtered on repository.nameWithOwner; more than 50 links stops the job (pageInfo.hasNextPage) instead of dropping the rest. Notes: the issue is closed before it is commented, so a failed close leaves no 'Closed by' comment; a PR a person merged is left to GitHub (mergedBy.login != github-actions). Checked live, read-only: on #908 the script reports '#801 already closed', on #828 'merged by cdeust: GitHub closes its issues'.
|
Remarques bloquantes de la review 1 traitées dans le dernier Note « fichier généré » : le gabarit |
|
Claude finished @cdeust's task in 1m 37s —— View job PR #922 review (2 of 3)
Review 1 blockers:
New blockers: none. Notes, no action before merge:
Verdict: approve |
Review 2 of 3: PR #922 (
|
Problem
GitHub does not act on closing keywords (
Closes #N) when the merge is made with the workflow'sGITHUB_TOKEN, and that is how the resolver merges (PUT /pulls/N/mergeinpipeline-post-merge.yml). The history of merged PRs that carry a closing keyword shows the split:cdeustgithub-actions[bot])Every PR the resolver merges with
Closes #Ntherefore leaves a finished issue open.Change
close-issuesjob inpipeline-post-merge.yml.resolve, outside the test chain, so a failure shows red without blocking the merged commit's tests.closingIssuesReferencesover GraphQL; that is GitHub's own parse of the keywords, not a regex of ours.state_reason: completed, and leaves issues that are already closed alone.issues: write,pull-requests: read, nothing else.resolveexposespr_number, which its script already wrote toGITHUB_OUTPUT.pipeline-after-merge.yml(the caller of the reusable workflow) grantsissues: write. The contracts name the new permission and job:ci_pipeline_routes.pyfor the caller's permissions, andci_pipeline_profiles.pyforPOST_MERGE_NEEDSand the condition of the job.This is the workflow's
GITHUB_TOKEN. The Claude App permissions and branch protection are untouched.Tests
tests_py/scripts/test_ci_resolver_closes_issues.pyruns the job's own script against a fake API:completed;resolve, its condition isresolvesuccess, its only permissions areissues: writeandpull-requests: read, andpr_numberis exposed.87 tests and 312 subtests pass across the CI contract suites (
check_ci_gate_complete,ci_pipeline_routes,ci_pipeline_source_contract, the resolver's verdict tests). The no-main-comparison guard passes, andscripts/check_ci_gate_complete.pyreports OK.ruff checkandruff format --checkpass on the touched files; the 2 E501 left inci_pipeline_source_contract.pypredate this PR.scripts/check_craftsmanship.py: OK.The first real proof will come after merge: the next resolver merge of a PR with
Closes #N.