fix(ci): harden repository reconciliation drift detection - #1788
Open
groupthinking with Copilot wants to merge 3 commits into
Open
fix(ci): harden repository reconciliation drift detection#1788groupthinking with Copilot wants to merge 3 commits into
groupthinking with Copilot wants to merge 3 commits into
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-authored-by: groupthinking <154503486+groupthinking@users.noreply.github.com>
![vercel[bot]](https://avatars.githubusercontent.com/in/8329?s=60&v=4){kind=small}
Copilot
AI
changed the title
[WIP] Fix repository drift report issues
fix(ci): harden repository reconciliation drift detection
Sep 8, 2026
groupthinking
approved these changes
Sep 12, 2026
groupthinking
marked this pull request as ready for review
September 12, 2026 08:03
Contributor
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
… references and silently maps them onto local issue numbers, mis-binding PRs and fabricating duplicate groups.
This commit fixes the issue reported at .github/workflows/repository-reconciliation.yml:40
## Bug
The closing-reference regex was broadened from `...#(\d+)` to:
```js
/(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+(?:[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)?#(\d+)/gi
```
The `(?:[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)?` prefix group is **non-capturing** and matches **any** `owner/repo`, but it is never compared against `repoFullName` (`${owner}/${repo}`). Only the trailing number is captured (`m[1]`), and downstream it is validated/classified against the **local** repo:
```js
const resp = await github.rest.issues.get({ owner, repo, issue_number: issueNum });
```
### Concrete trigger
A PR body containing `Closes otherorg/otherrepo#42` is parsed as issue `42`. It is then:
1. Validated via `issues.get({ owner, repo, issue_number: 42 })` against the **local** repo — if a local issue #42 exists, the PR is treated as canonically tracked by the wrong issue.
2. Added to `issueToPulls.get(42)`, so if another local PR legitimately references local #42, they are reported as a **false "competing PRs" duplicate group**, and the superseded-draft auto-close remediation could then act on them.
This silently binds a PR to the wrong (local) issue and can trigger destructive remediation (auto-closing draft PRs).
## Fix
- Made the repo prefix a **capturing** group so it can be inspected; the issue number is now `m[2]`.
- Added an `extractIssueNumbers(body)` helper that accepts a reference only when the prefix is **absent** (unqualified `#N`) or **equal to the current repo's full name** (`owner/repo#N`), discarding cross-repo references.
- Replaced both matchAll sites (issue-number collection and per-PR classification) with the helper.
Verified via a standalone Node script:
```
unqualified: [ 900 ]
local qualified: [ 900 ]
foreign: []
mixed: [ 5, 7 ]
```
Foreign references are dropped while the intended canonical repo-qualified form (`#900`) is still accepted.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: groupthinking <garveyht@gmail.com>
Contributor
|
Backlog triage: leaving open. Drift-detection harden (#1584) is CONFLICTING vs rewritten |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Canonical issue
Outcome
Repository reconciliation stops flagging valid PRs as missing a canonical issue when they use repo-qualified closing refs or when the linked issue has already been closed. The drift report also refreshes on the repository events that actually change reconciliation state instead of waiting for the daily cron.
Scope
pull_request_targetlifecycle changes,issuesopen/close changes, and branchcreate/delete.Closes #123andCloses owner/repo#123.github-scriptagainst stubbed GitHub API responses for the two false-positive cases.Risk
.github/workflows/repository-reconciliation.ymlandtests/unit/test_repository_reconciliation_workflow.py.Verification
List exact automated and manual checks, tied to the current head SHA.
python -m pytest tests/unit/test_repository_reconciliation_workflow.py -q --override-ini=addopts=''Production evidence
Not applicable. This change is limited to GitHub workflow automation and its regression tests; there is no runtime, Vercel, or production-surface change.
Agent handoff