* fix(scripts): ignore superseded workflow runs in watch-pr-ci rollup classification
Draft->ready re-triggers leave cancelled superseded runs on the head SHA
forever, and GitHub's aggregate rollup state counts them, so the watcher
emitted terminal FAILURE while the replacement run was still in progress
and could never reach GREEN (observed on PR #113150, head bd1b9a0e).
- fetch run identity per check and resolve same-name checks to the newest
run/check id (GitHub latest-name-wins); drop cancelled checks from
replaced runs; keep older runs' unique jobs visible
- paginate statusCheckRollup contexts (bounded, 10 pages) so >100-context
rollups are not truncation-blind; changed or lost snapshots throw into
the bounded retry
- classify GREEN when aggregate FAILURE is explained solely by superseded
contexts with full visibility; truncation still fails conservatively
* ci: scope GitHub App token permissions in stale, labeler, auto-response, and pr-ci-sweeper
Fixes red main: #112963 bumped zizmor v1.22.0 -> v1.28.0, whose github-app
audit flags create-github-app-token mints without permission-* inputs (14
high findings, Workflow Sanity red on main since 3b7b2a2a1f). Most
workflows already migrated to scoped tokens; these four were stragglers.
Scopes follow each consumer's actual API surface: stale needs issues/PR
write plus actions read for its state-cache check; labeler needs label
CRUD (issues write), PR write, members read for maintainer gates, and
contents read where actions/labeler reads its config; auto-response needs
issues/PR write plus members read; pr-ci-sweeper needs actions write to
re-fire runs, checks read, and PR write. Verified locally with the exact
CI invocation (zizmor 1.28.0, repo config, regular persona, medium
severity/confidence): no findings, ignore/suppress counts match CI.
One-time maintainer-authorized bootstrap merge for the release-gate verifier policy. Exact hosted CI and all supporting workflow gates passed on 66133de419.
Add clawsweeper:queueable-fix, clawsweeper:source-repro, and
clawsweeper:fix-shape-clear to exempt-issue-labels in all 4 stale
workflow steps and the backfill-closures script's issueExemptLabels
set.
Previously, issues classified by ClawSweeper as actionable fix
candidates could still be marked stale and auto-closed, creating
a conflict between the two automation systems (e.g. #78640,
#81078, #81122 had both 'stale' and 'clawsweeper:queueable-fix').
Fixes#89564
Extends stale automation timelines:
- Issues: 30 days stale → 14 days close (44 total, was 12)
- PRs: 14 days stale → 7 days close (21 total, was 8)
PR #13209
Peter Steinberger