Repository navigation
fix(pr-pipeline): fix-ci refuses ci-fix-protected-path when the fix needs no protected path #9320
Description
Problem
On #9111, pr-unblock's fix-ci stopped with ci-fix-protected-path ("the CI fix changes .github/"), but the fix the PR needed touched no .github/ file. The PR sat red with needs-human for about 12 hours.
The real causes:
- Two new
.shfiles were committed with mode 100644 instead of executable. - The
generate-adapter.test.shfixture lacked the new required verbget-field-options, which failed check-skills and test-bash.
Issue Triage's worker fixed it by hand in 76e2cba: #9111
Expected
The protected-path refusal fires only when the model's proposed patch actually changes a protected path. A fix that needs no protected path is applied, or the refusal names the protected file it would have touched.
To investigate
- Whether the refusal is decided from the failing job's location (a
.github/workflowsjob) rather than from the patch's changed paths. - Whether a mode-only change (100644 to 100755) is classified as a protected-path change.
Reported by the Issue Triage session (F17).
Activity
github-actions commentedon Oct 23, 2026
Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.
Size: Small
Complexity: Medium
Uncertainty: Knowable
Flags: none
Understood: on #9111, fix-ci stopped with
ci-fix-protected-patheven though the needed fix (file modes and a test fixture) touched nothing under.github/. The PR sat red for about 12 hours. You expect the refusal to fire only when the proposed patch changes a protected path, and to name the file when it does. Two causes are still open: whether the refusal looks at the failing job's location instead of the patch's paths, and whether a mode-only change is counted as protected. Reading the fix-ci guard code should settle both. I found no likely duplicates among the open issues.Automated triage, applied by the lanes App.
melodic-automation-lanes commentedon Oct 23, 2026
Not admitted to the issue lane: Uncertainty knowable is not one of known; it has no
- [ ]task list to check. A recorded decision does not change these rules (.github/actions/resolve-config/admission-rules.json); a person who wants it worked addsagent-ready.