fix: drop the dead Actions-app allowance and add a post-apply convergence check - #169
Merged
Merged
Conversation
…ence check Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
cpitzi
enabled auto-merge (squash)
August 22, 2026 14:00
Contributor
terraform plan (success) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #148
Summary
Removes the GitHub Actions app from
music-curator's merge-gate push allowlist — an entry that every CI apply since 2026-08-12 has reported aschangedand that has never once appeared in live state — and adds a post-apply convergence check so this class of silent failure is a red run rather than a green one. Corrects every place in the repo that recorded #98's root cause, which was wrong.Why
The allowance cannot take. Classic branch protection admits only users, teams, and GitHub Apps installed on the repository as push actors; the built-in Actions identity behind
GITHUB_TOKENis not an installation (it is absent from the org's installation list), and GitHub refuses it deliberately — otherwise any collaborator could reachmainby authoring a workflow (community discussion #25305). The branch-protection mutation drops an ineligible actor silently, so the provider reports success, the read-back lacks the actor, and the next plan proposes it again. The id format was never the cause: #98's next-formatA_…id fails identically to the legacy one. Verified against the 2026-08-19 apply (Plan: … 1 to change→Modifications complete→ liverestrictions.appsstill[]).Nothing is lost by removing it. The capability it was meant to preserve — follow-fold's bot merge — has never been exercised: all 59 merged PRs in music-curator were merged by the owner, no
harvest/follows-*PR has ever been opened, and the workflow has run twice, both skipped by its own branch guard. It is also independently blocked by the required checks adopted on 2026-07-25, which never report on aGITHUB_TOKENpush. The decision on what replaces it (a dedicated installed App, a PAT of an allowed user, or no bot merge) is music-curator#87;gate_extra_allowancesstays as the extension point, with the eligibility rule in its comment.Changes
terraform/locals.tf—gate_extra_allowances = {}; comment rewritten to state what GitHub will and will not accept as a push actor, the verification command, and the history..github/workflows/terraform.yml— newverify convergencestep afterapply:terraform plan -detailed-exitcode, fails the job on exit 2. "Apply complete" is the provider's claim, not the state's. Read-only,-lock=false; the birth-labels race documented in the README is unaffected (a lost race fails theapplystep itself, and the next apply converges).terraform/README.md— merge-gate section no longer claims the music-curator allowance; adds the Actions-app ineligibility and the convergence check; adoption record corrected.docs/adr/0003-merge-gate-push-allowlist.md— dated Amendment; the original decision text is kept with an inline pointer, per the ADR convention of not rewriting history.fleet-reports/incidents/2026-08-12-merge-gate-silent-allowance-drop.md— dated Correction section closing the report's open item 5 and correcting defect (4)'s root cause. Register content unchanged (registercheck passes).Expected plan
Exactly one resource,
github_branch_protection.merge_gate["music-curator"], withpush_allowancesdroppingA_kwHNJr_NPAg— matching live state, so the apply is a no-op at GitHub and the convergence check's first real run should reportconverged. If it reports anything else, that is a second non-convergent resource worth knowing about.🤖 Generated with Claude Code