add /cc-ci-cleanup — reconcile, close dead PRs, report what blocks the rest #7

2026-08-11T19:17:19Z

autonomic-bot commented

2026-08-11 19:17:19 +00:00

25 open recipe PRs had accumulated and the list had stopped being readable — CI sweep artifacts that were never meant to merge sat beside genuine CVE fixes.

The finding that motivated it: three PRs the operator had been told were outstanding were already merged upstream — discourse #6 (140 CVEs), keycloak #6 (12 CVEs), n8n #5. That was invisible until the mirrors were reconciled, and mailu #6 had gone the same way earlier the same day.

The skill:

reconcile-upstream.sh --all FIRST — mandatory, and closes already-upstream PRs by itself.
pr-survey.py — deterministic facts per PR: behind_main, mergeable, diff_files, images it adds vs those already pinned in main, newest !testme verdict, branch kind, age.
Classify: CLOSE (CI artifact / obsolete / superseded / empty diff), NEEDS WORK (with the one specific action — rebase, re-run testme, operator input), READY.
Close the first group with a reason and a reopen hint. Never merges a recipe PR.
Report prioritised by attention deserved — CVE-carrying first.

One correctness detail worth the extra state: a failed diff fetch is reported as DIFF-UNREADABLE(do not close on this), never as an empty diff. gitea #4 reads that way (force-pushed branch) while being a verified, green, needed fix — and "empty diff" is a close signal.

Guardrails: close only on a positive signal (age alone is never a reason — several 60-day-old PRs here are green and mergeable), and never close a lone CVE fix however stale.

Not yet run end-to-end; the reconcile and survey stages are both exercised (that is how the three already-merged PRs were found).

25 open recipe PRs had accumulated and the list had stopped being readable — CI sweep artifacts that were never meant to merge sat beside genuine CVE fixes. **The finding that motivated it:** three PRs the operator had been told were outstanding were already merged upstream — discourse #6 (**140 CVEs**), keycloak #6 (**12 CVEs**), n8n #5. That was invisible until the mirrors were reconciled, and mailu #6 had gone the same way earlier the same day. **The skill:** 1. `reconcile-upstream.sh --all` FIRST — mandatory, and closes already-upstream PRs by itself. 2. `pr-survey.py` — deterministic facts per PR: `behind_main`, `mergeable`, `diff_files`, images it adds vs those already pinned in `main`, newest `!testme` verdict, branch kind, age. 3. Classify: **CLOSE** (CI artifact / obsolete / superseded / empty diff), **NEEDS WORK** (with the one specific action — rebase, re-run testme, operator input), **READY**. 4. Close the first group with a reason and a reopen hint. **Never merges a recipe PR.** 5. Report prioritised by attention deserved — CVE-carrying first. **One correctness detail** worth the extra state: a *failed* diff fetch is reported as `DIFF-UNREADABLE(do not close on this)`, never as an empty diff. gitea #4 reads that way (force-pushed branch) while being a verified, green, needed fix — and "empty diff" is a close signal. Guardrails: close only on a positive signal (age alone is never a reason — several 60-day-old PRs here are green and mergeable), and never close a lone CVE fix however stale. Not yet run end-to-end; the reconcile and survey stages are both exercised (that is how the three already-merged PRs were found).

autonomic-bot added 1 commit 2026-08-11 19:17:19 +00:00

add /cc-ci-cleanup — reconcile, close dead PRs, report what actually blocks the rest fae2fbe21b

25 open recipe PRs had accumulated, and the list had stopped being readable: CI
sweep artifacts that were never meant to merge sat next to genuine CVE fixes, and
three PRs the operator had been told were outstanding were in fact already merged
upstream (discourse #6 with 140 CVEs, keycloak #6 with 12, n8n #5) — visible only
once the mirrors were reconciled.

The skill: reconcile every mirror from true upstream FIRST (that step alone closed
those three), survey every open PR deterministically, close the ones that cannot
merge or were never meant to, and report prioritised action items — CVE-carrying
first — for the ones that should land. It never merges a recipe PR.

pr-survey.py gathers the facts and decides nothing: behind_main, mergeable,
diff_files, which images the PR adds vs which are already pinned in main, the
newest !testme verdict, branch kind, age.

One correctness detail worth the extra state: a FAILED diff fetch is reported as
unknown, never as an empty diff. gitea #4 reads that way (force-pushed branch)
while being a verified green fix, and 'empty diff' is a close signal — so the
tool says DIFF-UNREADABLE(do not close on this) instead.

autonomic-bot merged commit c352ea9058 into main

2026-08-11 19:17:20 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci-orchestrator#7