fix(ci): harden polling timeout bounds and stale-head wait coverage

Agent-Logs-Url: https://github.com/wallstop/fortress-rollback/sessions/29c2fe6c-90ea-431c-ab05-f80a559e330f

Co-authored-by: wallstop <[email protected]>

Author: Copilot

scripts/ci/docker-network-tests.sh

@@ -141,6 +141,8 @@ run_test() {
     # Wait for containers to exit (poll their status)
     local elapsed=0
     local poll_interval=2
+    local remaining
+    local sleep_for
     while [ $elapsed -lt $wait_timeout ]; do
         # Check if both containers have exited
         local peer1_running peer2_running
@@ -151,8 +153,14 @@ run_test() {
             break
         fi
 
-        sleep $poll_interval
-        elapsed=$((elapsed + poll_interval))
+        remaining=$((wait_timeout - elapsed))
+        sleep_for=$poll_interval
+        if [ "$sleep_for" -gt "$remaining" ]; then
+            sleep_for=$remaining
+        fi
+
+        sleep "$sleep_for"
+        elapsed=$((elapsed + sleep_for))
     done
 
     # Collect logs from both containers

scripts/ci/enable-dependabot-automerge.sh

@@ -60,6 +60,8 @@ required_checks_count() {
 
 wait_for_required_checks() {
     local elapsed=0
+    local remaining
+    local sleep_for
     local required_count
 
     while ((elapsed <= REQUIRED_CHECKS_APPEAR_TIMEOUT_SECONDS)); do
@@ -82,12 +84,18 @@ wait_for_required_checks() {
             return 0
         fi
 
-        if ((elapsed == REQUIRED_CHECKS_APPEAR_TIMEOUT_SECONDS)); then
+        remaining=$((REQUIRED_CHECKS_APPEAR_TIMEOUT_SECONDS - elapsed))
+        if ((remaining <= 0)); then
             break
         fi
 
-        sleep "$REQUIRED_CHECKS_POLL_INTERVAL_SECONDS"
-        elapsed=$((elapsed + REQUIRED_CHECKS_POLL_INTERVAL_SECONDS))
+        sleep_for="$REQUIRED_CHECKS_POLL_INTERVAL_SECONDS"
+        if ((sleep_for > remaining)); then
+            sleep_for="$remaining"
+        fi
+
+        sleep "$sleep_for"
+        elapsed=$((elapsed + sleep_for))
     done
 
     echo "No required checks detected for PR within timeout; refusing to enable auto-merge." >&2

scripts/tests/test_enable_dependabot_automerge.py

@@ -24,6 +24,33 @@ def _write_stub_gh(path: Path) -> None:
 shift
 shift || true
 
+next_sequence_value() {
+    local sequence="$1"
+    local default_value="$2"
+    local counter_key="$3"
+    local state_dir="${GH_STATE_DIR:?GH_STATE_DIR is required}"
+    local index_file="$state_dir/$counter_key.idx"
+    local index=0
+
+    if [[ -z "$sequence" ]]; then
+        printf '%s\\n' "$default_value"
+        return
+    fi
+
+    if [[ -f "$index_file" ]]; then
+        index="$(cat "$index_file")"
+    fi
+
+    IFS=',' read -r -a values <<< "$sequence"
+    if ((index < ${#values[@]})); then
+        printf '%s\\n' "${values[$index]}"
+    else
+        printf '%s\\n' "${values[$((${#values[@]} - 1))]}"
+    fi
+
+    printf '%s\\n' $((index + 1)) > "$index_file"
+}
+
 if [[ "$cmd" == "pr" && "$subcmd" == "view" ]]; then
     jq_expr=""
     while [[ $# -gt 0 ]]; do
@@ -37,7 +64,7 @@ def _write_stub_gh(path: Path) -> None:
         ".state") printf '%s\\n' "${GH_PR_STATE:-OPEN}" ;;
         ".isDraft") printf '%s\\n' "${GH_PR_DRAFT:-false}" ;;
         ".autoMergeRequest != null") printf '%s\\n' "${GH_PR_AUTO_MERGE:-false}" ;;
-        ".headRefOid") printf '%s\\n' "${GH_PR_HEAD_OID:-head-sha}" ;;
+        ".headRefOid") next_sequence_value "${GH_PR_HEAD_OID_SEQUENCE:-}" "${GH_PR_HEAD_OID:-head-sha}" "head_ref_oid" ;;
         *) exit 1 ;;
     esac
     exit 0
@@ -79,7 +106,7 @@ def _write_stub_gh(path: Path) -> None:
 if [[ "$cmd" == "pr" && "$subcmd" == "checks" ]]; then
     printf '%s\\n' "pr checks $*" >> "${GH_LOG_PATH:?GH_LOG_PATH is required}"
     if [[ "$*" == *"--json name --jq length"* ]]; then
-        printf '%s\\n' "${GH_REQUIRED_CHECKS_COUNT:-1}"
+        next_sequence_value "${GH_REQUIRED_CHECKS_COUNT_SEQUENCE:-}" "${GH_REQUIRED_CHECKS_COUNT:-1}" "required_checks_count"
         exit 0
     fi
     if [[ "$*" == *"--watch"* ]]; then
@@ -108,6 +135,7 @@ def _run_script(tmp_path: Path, extra_env: dict[str, str]) -> subprocess.Complet
             "GITHUB_REPOSITORY": "wallstop/fortress-rollback",
             "GH_TOKEN": "fake-token",
             "GH_LOG_PATH": str(log_path),
+            "GH_STATE_DIR": str(tmp_path),
             "REQUIRED_CHECKS_APPEAR_TIMEOUT_SECONDS": "0",
             "REQUIRED_CHECKS_POLL_INTERVAL_SECONDS": "1",
             "REQUIRED_CHECKS_WATCH_INTERVAL_SECONDS": "1",
@@ -213,3 +241,115 @@ def test_fails_when_required_checks_fail(tmp_path: Path) -> None:
     assert "--json name --jq length" in log_lines[0]
     assert "--watch" in log_lines[1]
     assert "pr merge" not in "\n".join(log_lines)
+
+
+def test_waits_for_required_checks_to_appear_then_merges(tmp_path: Path) -> None:
+    result = _run_script(
+        tmp_path,
+        {
+            "GH_REQUIRED_CHECKS_COUNT_SEQUENCE": "0,0,1",
+            "GH_MERGE_SUCCESS_FLAG": "--squash",
+            "GH_ALLOW_SQUASH": "true",
+            "GH_ALLOW_REBASE": "false",
+            "GH_ALLOW_MERGE": "false",
+            "REQUIRED_CHECKS_APPEAR_TIMEOUT_SECONDS": "3",
+            "REQUIRED_CHECKS_POLL_INTERVAL_SECONDS": "1",
+        },
+    )
+    assert result.returncode == 0
+
+    log_lines = (tmp_path / "gh.log").read_text(encoding="utf-8").splitlines()
+    assert len(log_lines) == 5
+    assert "--json name --jq length" in log_lines[0]
+    assert "--json name --jq length" in log_lines[1]
+    assert "--json name --jq length" in log_lines[2]
+    assert "--watch" in log_lines[3]
+    assert "--squash" in log_lines[4]
+
+
+def test_skips_when_head_becomes_stale_while_waiting(tmp_path: Path) -> None:
+    result = _run_script(
+        tmp_path,
+        {
+            "GH_REQUIRED_CHECKS_COUNT_SEQUENCE": "0,0,1",
+            "GH_PR_HEAD_OID_SEQUENCE": "head-sha,head-sha,new-head-sha",
+            "GH_ALLOW_SQUASH": "true",
+            "GH_ALLOW_REBASE": "false",
+            "GH_ALLOW_MERGE": "false",
+            "REQUIRED_CHECKS_APPEAR_TIMEOUT_SECONDS": "3",
+            "REQUIRED_CHECKS_POLL_INTERVAL_SECONDS": "1",
+        },
+    )
+    assert result.returncode == 0
+    assert "PR head moved while waiting for required checks" in result.stdout
+
+    log_lines = (tmp_path / "gh.log").read_text(encoding="utf-8").splitlines()
+    assert len(log_lines) == 1
+    assert "--json name --jq length" in log_lines[0]
+    assert "--watch" not in log_lines[0]
+    assert "pr merge" not in log_lines[0]
+
+
+def test_skips_when_head_becomes_stale_after_checks_appear(tmp_path: Path) -> None:
+    result = _run_script(
+        tmp_path,
+        {
+            "GH_REQUIRED_CHECKS_COUNT_SEQUENCE": "1",
+            "GH_PR_HEAD_OID_SEQUENCE": "head-sha,head-sha,new-head-sha",
+            "GH_ALLOW_SQUASH": "true",
+            "GH_ALLOW_REBASE": "false",
+            "GH_ALLOW_MERGE": "false",
+        },
+    )
+    assert result.returncode == 0
+    assert "PR head moved after required checks appeared" in result.stdout
+
+    log_lines = (tmp_path / "gh.log").read_text(encoding="utf-8").splitlines()
+    assert len(log_lines) == 1
+    assert "--json name --jq length" in log_lines[0]
+    assert "--watch" not in log_lines[0]
+    assert "pr merge" not in log_lines[0]
+
+
+def test_skips_when_head_becomes_stale_after_checks_complete(tmp_path: Path) -> None:
+    result = _run_script(
+        tmp_path,
+        {
+            "GH_REQUIRED_CHECKS_COUNT_SEQUENCE": "1",
+            "GH_PR_HEAD_OID_SEQUENCE": "head-sha,head-sha,head-sha,new-head-sha",
+            "GH_ALLOW_SQUASH": "true",
+            "GH_ALLOW_REBASE": "false",
+            "GH_ALLOW_MERGE": "false",
+        },
+    )
+    assert result.returncode == 0
+    assert "PR head moved after required checks completed" in result.stdout
+
+    log_lines = (tmp_path / "gh.log").read_text(encoding="utf-8").splitlines()
+    assert len(log_lines) == 2
+    assert "--json name --jq length" in log_lines[0]
+    assert "--watch" in log_lines[1]
+    assert "pr merge" not in "\n".join(log_lines)
+
+
+def test_caps_poll_sleep_to_remaining_timeout(tmp_path: Path) -> None:
+    result = _run_script(
+        tmp_path,
+        {
+            "GH_REQUIRED_CHECKS_COUNT_SEQUENCE": "0,1",
+            "GH_MERGE_SUCCESS_FLAG": "--squash",
+            "GH_ALLOW_SQUASH": "true",
+            "GH_ALLOW_REBASE": "false",
+            "GH_ALLOW_MERGE": "false",
+            "REQUIRED_CHECKS_APPEAR_TIMEOUT_SECONDS": "1",
+            "REQUIRED_CHECKS_POLL_INTERVAL_SECONDS": "10",
+        },
+    )
+    assert result.returncode == 0
+
+    log_lines = (tmp_path / "gh.log").read_text(encoding="utf-8").splitlines()
+    assert len(log_lines) == 4
+    assert "--json name --jq length" in log_lines[0]
+    assert "--json name --jq length" in log_lines[1]
+    assert "--watch" in log_lines[2]
+    assert "--squash" in log_lines[3]