fix(fr-gate): attribute items via commits/pulls, not commit subjects - #90
Merged
Conversation
Contributor
Author
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Replaces the commit-subject '(#N)' scrape (both the item list and the
attribution vouch) with GitHub's authoritative commit->PR attribution
(repos/{repo}/commits/{sha}/pulls). The scrape was unreliable three ways under
this org's '<subject> (#issue) (#PR)' convention:
1. it grabbed ISSUE numbers -> pullRequest() NOT_FOUND -> gate failed CLOSED
(backend#1228: 16 issue-refs, e.g. #1005);
2. it grabbed bare '#N' MENTIONS of unrelated PRs (#234/#472 style); and
3. it MISSED a commit's real PR when the (#PR) wasn't in the subject
(rebase-merges / issue-only squash subjects) -> a naive NOT_FOUND-skip then
failed OPEN, since UNATTRIB counts an (#issue) subject as attributed and the
real PR is never gated (Bugbot High on the first cut of this PR).
commits/{sha}/pulls returns the actual MERGED PR(s) that introduced each commit
-- the single source of truth for both PRS and UNATTRIB. One call per commit not
already vouched by a PR-merge (M^1..M^2); retry; fail CLOSED on a persistent API
error. The --depth=200 base fetch bounds the commit set and the call count.
Validated against backend#1228's exact failing range (staging 0e4af47d ..
develop 8ddbbef2, 41 non-merge commits): yields 39 real merged PRs, ZERO
issue-ref leaks, ZERO false-unattributable, drops the #234/#472 mention-noise,
and correctly keeps #1191 (a genuine containing PR). actionlint clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
LukasWodka
force-pushed
the
fix/fr-gate-skip-issue-refs
branch
from
July 27, 2026 10:47
048ed81 to
edc65f9
Compare
LukasWodka
changed the title
Contributor
Author
|
bugbot run |
commits/{sha}/pulls lists EVERY PR whose branch contains a commit, so a sync
merge ("Merge develop into feature") was listed for the feature PR. The old
non-empty check let that sync merge enter MERGES and mark a direct-push-to-base
it happened to pull in as "covered", skipping Pass 2 and reopening the Bugbot
#73 fail-open hole. Require merge_commit_sha==sha so only true PR merges vouch;
any other merge drops its payload to Pass 2 for individual attribution.
Verified on real history: backend sync merge ba80b3a yields no merge_commit_sha
match (drops to Pass 2), while every 'Merge pull request #N' matches #N.
Addresses Bugbot 'Sync merges reopen attribution hole'.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
Author
|
bugbot run |
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit b54b422. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug (multi-symptom, one root)
fr-gatederived its "contained items" and its attribution vouch by scraping(#N)from commit subjects. Under this org's<subject> (#issue) (#PR)convention that's unreliable three ways:pullRequest(number:N)returnsNOT_FOUND→ treated as an API failure → 5 retries → "Status unreadable" → fail CLOSED. (backend#1228: 16 issue-refs, e.g. #1005.)#Nmentions of unrelated old PRs (the #234 / #472 style).(#PR)isn't in the subject at all (rebase-merges; squash subjects that kept only the issue ref). A naive skip-NOT_FOUND patch then failed OPEN —UNATTRIBcounts an(#issue)subject as "attributed", so the real PR is never discovered or gated (Bugbot High on the first cut of this PR).The fix
Build both the item list (
PRS) and the attribution (UNATTRIB) from GitHub's authoritative commit→PR attribution —repos/{repo}/commits/{sha}/pullsreturns the actual merged PR(s) that introduced each commit — instead of scraping subjects:M^1..M^2range and contribute their PR (sync merges contribute nothing; their pushes fall to pass 2).UNATTRIB(fail closed). Persistent API error ⇒ fail closed.PRS→ gate-the-promotion-PR fallback stays, so the gate can never pass on nothing.--depth=200base fetch bounds the commit set (and the call count).Validation
Ran the exact logic against #1228's real failing range (
staging 0e4af47d .. develop 8ddbbef2, 41 non-merge commits):UNATTRIBempty)actionlintclean. This is thecommits/pulls-primary approach backend#1265 called for.Note
High Risk
Changes the required promotion gate’s item discovery and direct-push detection; incorrect attribution could block valid releases or miss unreviewed commits.
Overview
Replaces subject-line
(#N)scraping in the FR gate “Discover items” step with GitHub’scommits/{sha}/pullsAPI as the source of truth for which merged PRs are in the promotion and whether every commit is attributable.Pass 1 resolves merge commits via the API and only treats them as PR merges when
merge_commit_shamatches the commit (so sync merges don’t vouch for unrelated base-branch pushes). Pass 2 walks non-merge commits not already covered by that vouching; each gets an API lookup for merged PRs, with retries and fail-closed on persistent API errors. The gated PR list (prs) is built from deduped attributed PR numbers instead of parsed subjects.This addresses false failures from issue refs in subjects, noise from mentioned PR numbers, and fail-open gaps when the real PR isn’t in the subject (rebase/squash cases).
Reviewed by Cursor Bugbot for commit b54b422. Bugbot is set up for automated code reviews on this repo. Configure here.