From ba54f6c21531c40bff62dfd1ec128a141b372d86 Mon Sep 17 00:00:00 2001 From: Amr AbuSair Date: Fri, 28 Aug 2026 08:39:42 -0500 Subject: [PATCH 1/3] fix(compliance): skip re-checking PRs that already have a successful status Posting a commit status bumps the PR's updated_at, which puts it right back into the sweeper's 24h lookback window. An already-resolved PR (e.g. "Member Bypass", "CLA Signed") then gets re-confirmed and re-stamped every 5-minute sweep cycle forever, since each repaint resets the very timestamp the sweeper uses to decide what's "recent". Confirmed live: open-vm-tools#802 repainted 30x over ~2 days, ansible-vsphere-gos-validation#931 repainted 7x. process_single_pr() now checks the commit's existing "Check CLA/DCO" status before doing anything else, and returns immediately if it's already "success" - before the bot/member checks, before fetching the shared config, before re-posting. A genuinely new commit has a fresh SHA with no prior status, so this only ever skips true no-op repeats. Co-Authored-By: Claude Sonnet 5 --- scripts/policy_selector.py | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/scripts/policy_selector.py b/scripts/policy_selector.py index 6fe1e0c..b9d2700 100644 --- a/scripts/policy_selector.py +++ b/scripts/policy_selector.py @@ -314,6 +314,18 @@ def set_commit_status(api_root, repo, sha, state, description, target_url, token debug_log(f"⚡ Painting Commit {sha[:7]} as '{state}'...") github_api(url, token, "POST", payload) +def get_existing_status_state(api_root, repo, sha, token): + """Returns the current state of our STATUS_CONTEXT on this commit + ('success'/'failure'/'pending'), or None if we haven't posted one yet.""" + url = f"{api_root}/repos/{repo}/commits/{sha}/status" + data = github_api(url, token) + if not data: + return None + for s in data.get("statuses", []): + if s.get("context") == STATUS_CONTEXT: + return s.get("state") + return None + from datetime import datetime # --- UPDATED: Retry Loop for Database Contention --- @@ -436,6 +448,17 @@ def process_single_pr(pr_number, pr_head_sha, pr_user, repo_full_name, gh_token, gh_token = os.environ.get("GH_TOKEN") or gh_token debug_log(f"🔍 Checking PR #{pr_number} by @{pr_user}...") + # 0. Already-Resolved Check + # Posting a status bumps the PR's updated_at, which can put it right back + # into the sweeper's lookback window — repeatedly re-confirming an + # already-successful PR just repaints the same result and pushes + # updated_at again, looping forever every sweep cycle. A new commit gets + # a fresh SHA (no prior status), so this only skips true no-op re-checks. + existing_state = get_existing_status_state(api_root, repo_full_name, pr_head_sha, gh_token) + if existing_state == "success": + debug_log(f"✅ PR #{pr_number} already has a successful '{STATUS_CONTEXT}' status on {pr_head_sha[:7]}. Skipping re-check.") + return + # 1. Bot Check if pr_user in BOT_ALLOWLIST or pr_user.endswith("[bot]"): set_commit_status(api_root, repo_full_name, pr_head_sha, "success", "Bot Bypass", "", gh_token) From e9f8d24451fafe71948f5eefe6e59bc1634dfc2d Mon Sep 17 00:00:00 2001 From: Amr AbuSair Date: Fri, 28 Aug 2026 08:39:52 -0500 Subject: [PATCH 2/3] chore(compliance): temporarily point sweeper checkout at test branch TEMPORARY: for live-testing the skip-already-resolved-PRs fix via a real workflow_dispatch run before merge. Revert to ref: main before merging, same as the PR #66 test process. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/cla_sweeper.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cla_sweeper.yml b/.github/workflows/cla_sweeper.yml index 36362d2..8b3ac32 100644 --- a/.github/workflows/cla_sweeper.yml +++ b/.github/workflows/cla_sweeper.yml @@ -44,7 +44,7 @@ jobs: repository: ${{ vars.CENTRAL_ORG }}/.github token: ${{ steps.app-token.outputs.token }} path: .github-tools - ref: main + ref: fix/skip-already-resolved-prs # TEMPORARY: live-test before merge, revert to main before merging sparse-checkout: | scripts From 356939db5895e2a0fbb94f22b8796a92d32a6090 Mon Sep 17 00:00:00 2001 From: Amr AbuSair Date: Fri, 28 Aug 2026 08:45:12 -0500 Subject: [PATCH 3/3] chore(compliance): revert temporary test ref in cla_sweeper.yml Was pointed at this branch to live-test the skip-already-resolved-PRs fix via a real workflow_dispatch run before merge - confirmed working (12 already-resolved PRs correctly skipped, 1 genuinely non-compliant PR correctly still repainted, zero updated_at bumps). Restoring ref: main now that testing is done. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/cla_sweeper.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cla_sweeper.yml b/.github/workflows/cla_sweeper.yml index 8b3ac32..36362d2 100644 --- a/.github/workflows/cla_sweeper.yml +++ b/.github/workflows/cla_sweeper.yml @@ -44,7 +44,7 @@ jobs: repository: ${{ vars.CENTRAL_ORG }}/.github token: ${{ steps.app-token.outputs.token }} path: .github-tools - ref: fix/skip-already-resolved-prs # TEMPORARY: live-test before merge, revert to main before merging + ref: main sparse-checkout: | scripts