Repository navigation
Issue dependencies: follow-ups deferred from the PR #1035 review #1039
Description
Summary
Follow-ups for the issue-dependency mechanism (#1034, PR #1035) that a nine-part review of the pull request raised and that were deliberately left out of it. The pull request fixed the merge-gate problems: closing exemptions now come from GitHub's own closingIssuesReferences; links are read from the title, description and commit messages; failures in sync are isolated; linked issues are capped; a missing issue number is no longer an error. What is below either needs a decision, cannot change the gate's outcome, or is hardening for situations the repository does not have today.
Items
| # | Item | Why it was left out | Proposed change |
|---|---|---|---|
| 1 | A Refs mention can be hidden from the lenient reader by CommonMark constructs it does not model: a code span that contains <!--, backslash-escaped backticks, abrupt comments (<!-->), fences inside blockquotes or list items, raw <pre> blocks. |
Closing references come from GitHub, so this no longer affects exemptions. A hidden Refs has the same effect as leaving the reference out, which no reader can detect. |
A single-pass scanner that applies CommonMark precedence (the construct that starts first wins) and escapes, or a vetted GFM parser vendored under tools/ (no new runtime dependency). |
| 2 | An override is not bound to the head commit or the linked issues the maintainer saw. | The check now lists what an override accepts, and CONTRIBUTING asks maintainers to re-read a pull request that changed after the label was set. | Record the head SHA when the override is set (for example in a bot comment marker) and ignore the label once the head or the linked set changes. |
| 3 | The check and its scripts can be weakened by a pull request that changes .github/ or tools/, and branch protection cannot tell two Actions checks of one name apart. |
Requiring code-owner review is an owner decision: the repository has one maintainer, and approvals are not required today. | Require code-owner review for .github/**, tools/issue_dependencies.py and tools/assign_on_comment.py once a second maintainer exists, or move the check to an app whose source can be pinned. |
| 4 | /assign: when reading the dependencies fails, the reply says a maintainer will assign by hand, without saying to check Blocked by first. |
Rare; the maintainer still decides. | A distinct failure message for a dependency read. |
| 5 | Paginated reads stop silently at their bound, and a list that is an exact multiple of the page size costs one more request. | Bounds are far above the repository's scale. | Follow Link: rel=next; warn when a bound is reached. |
| 6 | No retry or backoff for transient API errors. | The hourly sync and the reconciliation re-run recover. | Retry idempotent reads with backoff, honouring Retry-After. |
| 7 | After a repository rename or transfer, the github.repository == 'HodeTech/ForgeLM' guard turns the sync into a silent skip. |
No rename is planned. | A runbook line in MAINTAINERS.md, or a guard that does not depend on the name. |
| 8 | No merge_group trigger. |
The repository has no merge queue. | Add merge_group (and read its payload) when a merge queue is enabled. |
| 9 | Two pull requests that share a head SHA can see each other's check run. | Fork check runs often carry an empty pull_requests list, so filtering by it could hide real runs. |
Prefer the run whose pull_requests names this pull request; fall back to the latest. |
| 10 | Between adding a Blocked by link and the next hourly sync, an open pull request keeps its old result. | Documented; a maintainer can run the workflow by hand. | A shorter schedule, or a merge-time re-check. |
| 11 | A blocked label set by hand on a pull request is never removed; a transferred issue keeps blocked in its new repository. |
The label is issue-only by documentation; transfers are rare. | Clean blocked from pull requests in sync; react to transferred. |
| 12 | A second unblock with the same blocker set stays silent (the marker matches the first notice). | Rare; the label is still removed. | Add a monotonic part (for example the label event id) to the marker. |
| 13 | More than 3,000 events on a pull request make the override check fail. | Far above any pull request here. | Read only the most recent label events. |
| 14 | tools/ is outside the coverage gate. |
A project-wide coverage decision. | A separate coverage target for tools/. |
| 15 | Polish: contributing_url hard-codes development; /assign's MSG_RELEASED / MSG_LIMIT wording; ANSI stripping in _clean; a scaling-based ReDoS test as docs/standards/regex.md describes (timing ratios have been flaky here before, see #72); a pinned gh CLI version. |
Cosmetic, or a trade-off to weigh. | Take each on its own merits. |
Not taken up, with the reason: the claim that a required check must have passed within the last seven days is not supported by the branch-protection documentation, which only requires a successful, skipped or neutral result; the 30-day re-run window is handled.
Acceptance criteria
- Each item is done, or closed here with a reason; item 3 needs the owner's decision first.
- Every code change ships with a test in
tests/test_issue_dependencies.pyortests/test_assign_on_comment.py.
Activity
github-actions commentedon Oct 20, 2026
This issue is no longer blocked: every issue it waited for is closed as completed (#1034). It can be picked up now; see Working on an issue.
fix(ci): read a pull-request title as written, pin the full CI test run
feat(ci): bind the dependency override, read texts as GitHub renders …
fix(ci): read a pull-request title as written, pin the full CI test run
feat(ci): bind the dependency override, read texts as GitHub renders …