CI: Upload regen patch artifact when the uncommitted-changes check fails

[Croway]

Motivation

A lot of PRs fail on the Fail if there are uncommitted changes step of the Build and test workflow (generated files not regenerated/committed — e.g. #25939). At that point CI has already done the expensive work: regen.sh succeeded and the regenerated files are sitting in the runner's workspace — we currently just print the diff into the log and throw it away. Fixing such a PR today means checking it out and running a ~15 minute regen build locally.

Changes

pr-build-main.yml — when the uncommitted-changes check fails, the regenerated changes are saved with git diff --cached --binary and uploaded as a regen-patch artifact together with the PR number (the ci-comment artifact is not produced on this failure path, so the patch artifact must carry the PR number itself — same approach camel-quarkus uses for its dependabot branch synchronization).

pr-test-commenter.yml — the existing commenter workflow (which already runs in the base-repo context with pull-requests: write) now also looks for a regen-patch artifact on the completed run and posts/updates a single marker-based comment on the PR with ready-to-use apply instructions:

gh pr checkout <PR> --repo apache/camel
gh run download <RUN_ID> --repo apache/camel -n regen-patch
git apply --index regen.patch && rm regen.patch pr-number
git commit -m "Regen" && git push

git apply --index stages everything including newly added/deleted generated files (a plain git commit -am would miss untracked new files). When a later run is clean, the comment is updated to a resolved state instead of leaving a stale warning.

Who can use it

Anyone with push access to the PR branch: the PR author, or any committer/PMC member when Allow edits from maintainers is enabled on the fork PR (it is by default for user-owned forks). This makes fixing a contributor's failing PR a ~30 second operation.

Security considerations

No new tokens, secrets, or permissions are introduced. The patch is uploaded by the unprivileged build job as plain data; nothing applies it automatically — a human applies and pushes it with their own credentials, and the resulting commit goes through normal review. A possible follow-up (separate discussion) would be a /regen comment command that applies the patch from CI automatically, following the camel-quarkus synchronize-dependabot-branch.yaml pattern, but that requires a bot account PAT to push to forks — hence doing this cheap step first.

---

Claude Code on behalf of Croway

[gnodet]

Well-designed CI enhancement. The approach is correct, follows existing patterns in the workflow, and introduces no new permissions or secrets.

Nice touches:

• --binary flag on git diff handles potential binary generated files
• git add -A + git diff --cached captures newly-added untracked files that a plain git diff would miss
• overwrite: true on the regen-patch upload is consistent with the existing ci-comment artifact pattern
• Separate <!-- regen-patch --> marker avoids collisions with the existing <!-- ci-tested-modules --> test summary marker
• Idempotent comment logic: resolved comments aren't re-posted, new clean runs update warnings to resolved, errors handled gracefully with core.warning()
• All actions are SHA-pinned and match versions used elsewhere in the workflow

One minor gap (non-blocking): when a previously-failing regen check passes on a push where all tests also pass (no test comment produced), neither regen-patch nor ci-comment artifacts carry the PR number, so the old warning comment won't auto-resolve to the ✅ state. This is cosmetic — CI status badges show the real outcome, and the comment self-heals on the next push that produces test output. A low-priority follow-up could have the "Save PR number" step always upload a minimal artifact containing just the PR number.

📋 PR Metadata

Aspect	Current	Suggested
Milestone	(none)	4.23.0

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.