Skip to content

fix(ci): don't block Release Please PRs on Cursor Bugbot #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
teallarson wants to merge 1 commit into from
Closed

fix(ci): don't block Release Please PRs on Cursor Bugbot #60

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions .github/workflows/check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,17 +60,39 @@ jobs:
- if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
run: exit 1

# Release Please PRs only bump versions and the changelog, and Bugbot
# sometimes never starts on them, which would block the release. Skip it
# only while every commit is a GitHub-verified commit by the app that
# release-please.yml uses; a pushed commit from anyone else restores it.
- name: Require Cursor Bugbot on pull requests
if: github.event_name == 'pull_request'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
HEAD_REF: ${{ github.event.pull_request.head.ref }}
HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
PR_NUMBER: ${{ github.event.pull_request.number }}
RELEASE_BOT: arcade-plugin-bot[bot]
REPO: ${{ github.repository }}
run: |
set -euo pipefail

sha="${HEAD_SHA}"
repo="${REPO}"

if [ "${PR_AUTHOR}" = "${RELEASE_BOT}" ] && [ "${HEAD_REPO}" = "${repo}" ] && [[ "${HEAD_REF}" == release-please--* ]]; then
other_commits="$(
gh api "repos/${repo}/pulls/${PR_NUMBER}/commits" --paginate |
jq -s --arg bot "${RELEASE_BOT}" '[.[][] | select(.author.login != $bot or .commit.verification.verified != true)] | length'

@cursor cursor Bot Nov 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing permission fails release skip

High Severity

The skip path lists PR commits with GH_TOKEN, but the check job only grants checks: read. Job-level permissions replace the workflow grants and leave pull-requests as none, so gh api can 403 and set -euo pipefail fails the step before Bugbot is skipped or polled. Release Please PRs stay blocked, and check can fail even when Bugbot later succeeds.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ffb69a9. Configure here.

)"
if [ "${other_commits}" = "0" ]; then
echo "Release Please pull request with only ${RELEASE_BOT} commits; Cursor Bugbot not required"
exit 0
fi
echo "Release Please pull request has ${other_commits} commit(s) not made by ${RELEASE_BOT}; requiring Cursor Bugbot"
fi

deadline=$(( $(date +%s) + 900 ))

while [ "$(date +%s)" -lt "$deadline" ]; do
Expand Down
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,8 @@ downloads it.

CI runs each of these as its own job (`.github/workflows/check.yml`). The
**`check`** job waits for all of them and, on pull requests, for Cursor
Bugbot. Branch protection on `main` requires `check`.
Bugbot. Release Please PRs skip Bugbot while every commit on them is the
release bot's. Branch protection on `main` requires `check`.

## Release

Expand Down
Loading