Repository navigation
feat(stage): require an approved mirror PR when approval is on - #137
Merged
Merged
Conversation
With `approval` set to `reviewed` or `two-person`, stage reads the branch's open mirror PR into the mirror default branch through gh api (netExec) after the fetch: each reviewer's latest review (a dismissed latest review is no opinion), the mirror permission of each candidate approver, and every check run and commit status on the PR head. One approval must be on the head commit, from a User account that is not the PR author and has write or admin access; two-person also excludes the gh login running stage, and only two-person reads that login. Outstanding change requests, pending checks and failed checks block. A PR into another base is refused (wrong-base); several candidate PRs are refused (ambiguous-pr) and the hint names --internal-pr. The local branch must point at the approved head, and stage pins the rebuild to that commit with source.sha, so new commits after the approval do not ship. The upstream PR body comes from the approved mirror PR. Refusals are ApprovalError, code `approval`, exit 1, with a one-line hint; the self-approval and no-mirror-PR refusals name `venfork stage approval reviewed`. --dry-run reports the result in result.approval and still previews. Nothing about the approval goes into published commits or the upstream PR. With the level off, stage makes no new gh call. gh reads end in `| tojson` so output is one value per line on a TTY too. `stage issue` is not gated: it publishes redacted issue text, not code.
cabljac
force-pushed
the
gate/03-approval-gate
branch
from
October 19, 2026 17:26
a21b7f8 to
595108b
Compare
cabljac
marked this pull request as ready for review
October 19, 2026 17:29
cabljac
added this pull request to stack #142
October 19, 2026 17:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With
approvalon, stage now checks the branch's open mirror PR before it rebuilds anything. Throughgh api(netExec) it reads each reviewer's latest review (a dismissed one is no opinion), each approver's mirror permission, and every check run and commit status on the PR head. One approval must be on the head, from a User account that is not the PR author and has write or admin access;two-personalso excludes the gh login running stage, and onlytwo-personreads that login. Change requests, pending checks and failed checks block. The PR must target the mirror default branch; several candidates refuse and name--internal-pr. Stage pins the rebuild to the approved head and takes the upstream PR body from that PR.Refusals exit 1 with code
approvaland a hint.--dry-runreportsresult.approval.stage issueis not gated.Tests, red first:
tests/integration/approval-gate.test.ts, the envelope case intests/integration/cli.test.ts,tests/unit/approval.test.ts.bun run verifyexits 0. Counts: unit 1272 to 1283, integration 477 to 500.Not verified: e2e tiers and live GitHub. The gh calls are proven only against the stub in
tests/harness/gh-mirror.ts. Zero check runs still pass (deferred).