Opt ci-go's workflow_call arm out of signed auto-fixes so it does not race the org-required signer
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 88/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github-actions
- Domain
- ci-cd
Research direction
Start in .github/workflows/ci.yaml at the ci-go job and inspect its workflow_call inputs for the pinned devantler-tech/actions validate-go-project.yaml release. Confirm the actions pin involved in #1134 and the direct required run's signer behavior. Done when ci-go is read-only, the direct run remains the sole signer, and the workflow change is aligned with the pin bump.
Written by the indexing model from the issue text.
Description
🤖 Generated by the Agentic Engineer
Evidence
.github/workflows/ci.yaml's ci-go job calls devantler-tech/actions/.github/workflows/validate-go-project.yaml through workflow_call (pinned at v13.2.3 today) and passes APP_PRIVATE_KEY. Once this repository bumps past the release that turns signed auto-fix commits on by default (devantler-tech/actions#1134, Fixes devantler-tech/actions#1075), that arm opts in too — while the org-required direct run of the same workflow already signs for every pull request here.
Impact
On a same-repository pull request where both run, both would export a patch and dispatch apply jobs whose createCommitOnBranch mutation is pinned to the same branch tip; the second is rejected as stale. Today the only thing preventing that race is ci-go's govuln-allowlist path filter, under which the fixer lanes are skipped — a gate in another file that nothing ties to this behaviour. Found in review of devantler-tech/actions#1134.
Expected behaviour
Exactly one signer targets a pull-request branch here: the org-required direct run. The ci-go arm stays read-only.
Acceptance criteria
-
ci-gopassesapply-signed-fixes: false, with a comment naming the direct run as the signer. - Landed together with, or before, the actions pin bump that carries #1134.
Rough size: XS.
Part of devantler-tech/actions#1075
- Dominant language
- Go
- Stars
- 165
- Forks
- 13
- Avg merge
- 4h 17m
- Merged PRs (30d)
- 362
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from devantler-tech/ksail
-
dependencies go
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
devantler-tech/ksail#7135 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
devantler-tech/ksail#6977 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
devantler-tech/ksail#6975 ·
-
fix(webui): unmanaged clusters with URL-unsafe context names (EKS ARNs) 404 from every web request Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
devantler-tech/ksail#6908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
devantler-tech/ksail#6804 ·
All issues in devantler-tech/ksail
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100