Skip to content

Enhance kanban workflow with multi-stage validation and fixes#39

Open
saadqbal wants to merge 5 commits intomainfrom
develop
Open

Enhance kanban workflow with multi-stage validation and fixes#39
saadqbal wants to merge 5 commits intomainfrom
develop

Conversation

@saadqbal
Copy link
Copy Markdown
Contributor

@saadqbal saadqbal commented May 4, 2026

Note

Medium Risk
Medium risk because it changes GitHub Actions automation that updates Project v2 Status and can block promotions to staging/main/master if misconfigured (status names/options, tokens, commit-subject parsing). No application runtime or production data paths are touched.

Overview
Adds a multi-stage functional review flow to the kanban automation: deploy pushes now set Status to FR on dev/FR on staging/Prod (instead of only marking prod as Done) while still updating Deploy environment, and status updates now skip gracefully if the target option can’t be resolved.

Introduces an FR gate reusable workflow (with per-repo caller) that becomes a required check on promotions to staging/main/master, failing the PR unless all promoted items are already in Ready for staging/Ready for prod (with a visible skip-fr-gate override label).

Adds a /fr-pass comment handler (with per-repo caller) that advances items from FR on devReady for staging and FR on stagingReady for prod and reacts to the comment for feedback; updates kanban closure routing to use the new status names and default manual issue completion to Prod, and trims unneeded pull-requests: write permissions from wip-limit-check.yml.

Reviewed by Cursor Bugbot for commit d82b3f0. Bugbot is set up for automated code reviews on this repo. Configure here.

LukasWodka and others added 5 commits April 30, 2026 16:07
…yPullRequestsReferences

The previous PR's promotion accidentally pushed an empty file. Restoring full
workflow content + applying the intended issue-completed → mirror closing PR
status fix using closedByPullRequestsReferences (handles 'Closes #N' auto-closes
where ClosedEvent.closer returns Commit, not PullRequest).
#38)

* feat(kanban): split Functional review into multi-stage validation flow

Replaces the single "Functional review" column with four distinct states
that mirror the actual deploy pipeline:

  Code review → FR on dev → Ready for staging → FR on staging
              → Ready for prod → Done

Changes:
- advance-deploy-env.yml: now flips Status on develop/staging pushes too
  (previously only on main/master). develop → "FR on dev",
  staging → "FR on staging", main/master → "Done".
- kanban-closure-router.yml: routes merged PRs to the matching FR column
  by base branch (develop/staging/main).
- fr-pass-comment.yml (new): listens for "/fr-pass" PR comments from repo
  collaborators and advances FR-on-dev → Ready-for-staging or
  FR-on-staging → Ready-for-prod. Reacts 👍/👎 on the comment.
- fr-pass-comment-caller.yml (new): per-repo template for adoption.

The two "Ready for …" columns make deploy-cadence delays visible —
cards stuck there mean the next promotion (develop → staging or
staging → prod) is overdue.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(kanban): rename Done→Prod and gate promotions on Ready-for-X

Two changes layered on top of the multi-stage FR flow:

1. Rename "Done" column → "Prod" — option ID preserved (98236657),
   so existing items already on it stay put.

2. New fr-gate.yml workflow (with caller template):
   - PR target = staging  → all contained items must be in "Ready for staging"
   - PR target = main/master → all contained items must be in "Ready for prod"

   Item discovery uses the same commit-subject scan as advance-deploy-env
   (squash-merge "(#NNN)" + "Merge pull request #NNN") so we check every
   PR rolled into the promotion, not just the promotion PR itself.

   Failure mode: status check exits 1 with a clear "how to unblock"
   message. Override with the "skip-fr-gate" label for emergencies — the
   label is deliberately visible so we can audit overrides.

   Configured as a required status check via branch protection on
   staging + main/master so the merge button stays grey until the gate
   passes.

Workflow text updates: advance-deploy-env.yml + kanban-closure-router.yml
now use "Prod" everywhere they previously referenced "Done".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…#37)

The reusable workflow declared `permissions: pull-requests: write` on
its job. Callers (e.g. tracebloc-py-package) don't grant that, and
GitHub forbids called workflows from elevating GITHUB_TOKEN scope, so
the workflow short-circuited to `startup_failure` before any step ran.

The block is also unnecessary: this workflow doesn't use GITHUB_TOKEN
at all — `gh pr comment` runs under `secrets.PROJECTS_KANBAN_TOKEN`
(a PAT). Removing the block restores startup parity with the other
reusable workflows in this repo, none of which declare a permissions
block.

Verified locally that py-package PR #117 hit startup_failure with the
old YAML; all sibling reusables (set-pr-status, add-to-kanban, etc.)
have no permissions block and run fine.
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit d82b3f0. Configure here.

fi

echo "✓ FR gate PASSED. All items are in '$REQUIRED'."
[ -n "$MISSING" ] && echo " (skipped not-on-kanban:$MISSING)"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FR gate fails on successful validation happy path

High Severity

The last line [ -n "$MISSING" ] && echo "..." causes the script to exit with code 1 when $MISSING is empty — which is the normal success path where all items are on the kanban and pass validation. The [ -n "" ] test returns exit code 1, the && short-circuits, and since this is the script's final command, the shell exits with 1, causing GitHub Actions to mark the step as failed. Ironically, the gate only passes when some items are missing from the kanban (making $MISSING non-empty). Adding || true after the && chain or using an if statement would fix this.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit d82b3f0. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants