Name the required check that never ran - #19
Conversation
A green rollup is not a satisfied ruleset. On appeler/pranaam#10 all seven reported checks passed while the required 'build' context never ran at all -- its workflow had been cancelled by a concurrency collision -- and the PR sat BLOCKED for weeks looking entirely green. Counting reported checks cannot see that. The sweep already refused to act on BLOCKED, so nothing unsafe happened, but it reported only the symptom. It now fetches the ruleset's required contexts and names the ones with no check run on the PR. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 81acfb0fa5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| gh api "repos/${GH_REPO}/rulesets/${id}" --jq \ | ||
| '.rules[]? | select(.type=="required_status_checks") | ||
| | .parameters.required_status_checks[].context' 2>/dev/null |
There was a problem hiding this comment.
When a repository has disabled rulesets or separate rulesets targeting branches such as release/*, this loop unions their required contexts with those for the PR's base branch because it ignores each ruleset's enforcement and conditions. A blocked Dependabot PR to main can therefore be reported as missing checks that were never required or expected to run on it, defeating the diagnostic this change adds; collect only active rulesets whose conditions match the PR's base ref.
Useful? React with 👍 / 👎.
| absent = never_reported(pr) | ||
| reason = (f"required never ran: {','.join(absent)}" if absent | ||
| else pr["mergeStateStatus"]) |
There was a problem hiding this comment.
When a PR is conflicted or still a draft and any required context is absent, this branch replaces DIRTY or DRAFT with required never ran: .... In those states the conflict or draft status is the immediate reason merging is impossible, and checks may intentionally not have run, so the scheduled sweep now directs operators toward the wrong problem; apply the missing-context substitution only when mergeStateStatus is BLOCKED.
Useful? React with 👍 / 👎.
1 participant
A green rollup is not a satisfied ruleset.
On
appeler/pranaam#10all seven reported checks passed while the requiredbuildcontext never ran at all — its workflow had been cancelled by a concurrency collision when nine Dependabot PRs opened within a minute — and the PR satBLOCKEDfor weeks looking entirely green.The sweep already refused to act on
BLOCKED, so nothing unsafe happened. But it reported only the symptom, which sends a reader hunting for a failing check that does not exist. It now fetches the ruleset's required contexts and names the ones with no check run on the PR.Verified against the real #10 rollup plus fixtures:
🤖 Generated with Claude Code