Bot branch-sync heads leave required checks unapproved (#082)

[cursor]

Summary

When github-actions[bot] updates an open PR branch via .github/workflows/pr-branch-sync.yml, the resulting head produces action_required runs for CI, SAST, and Secret Scan. Those required checks never report, so the PR stays blocked even when the merge tree is clean.

Tracked in the repo ledger as #082 (docs/outstanding-issues.md). This GitHub issue exists so the work is visible outside the ledger.

Evidence

• PR issues: close #081 after PR #1196 was closed #1220 (2026-07-25): blocked through five successive syncs (e927cc3c, e74ce083, 84a224ba, 54bea70b, 0ab9e331); normal and --admin merge both refused.
• PR fix(ui): harden Sheet focus handling #1217 (2026-07-25): same stall on bot heads 4c228055 / f7208d52 / df42124a; cleared after applying skip-branch-sync and pushing an agent-authored head (f3f0a75b / 65f7580c), then merged.

Heads pushed by an agent or human still run normally.

Working mitigation (until fixed)

1. Apply the skip-branch-sync label (stops the re-sync loop).
2. Push an own-authored (non-bot) commit so required checks actually run.
3. Merge before removing the label if further syncs would re-stall the head.

Opt-out labels already wired in the workflow: hold, do-not-merge, skip-branch-sync.

Fix options (pick one)

1. Preferred: allow the sync bot identity in the repository Actions approval settings so bot-authored heads auto-run the required workflows.
2. Alternative: change the sync to push with a token whose workflow runs auto-execute (PAT / GitHub App), rather than github-actions[bot].
3. Fallback: drop or narrow auto-sync if the approval path cannot be fixed safely.

Success criteria

A bot-synced PR reaches green required checks with no manual / agent push.

Stop rules

• Do not widen Actions approval for fork / untrusted actors.
• Do not clear the block by bypassing required checks.

Related

• Workflow: .github/workflows/pr-branch-sync.yml
• Process note: docs/process-hardening.md § "Open PR branch sync"
• Ledger: docs/outstanding-issues.md #082

[coderabbitai]

🔗 Related PRs

#444 - fix: throttle Codex auto-resolve workflow [merged]
#445 - fix: harden Codex auto-resolve review guard [merged]
#455 - fix: harden Codex review auto-resolve flow [merged]
#716 - ci: enforce safer pull request evidence [merged]
#873 - fix(ci): preserve high-risk auto-resolve routing across renames [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[github-actions]

Summary of GitHub Issue #82:

Problem

When github-actions[bot] updates a branch on an open pull request (PR) via the pr-branch-sync workflow, the updated head triggers required checks (CI, SAST, and Secret Scan) but leaves them in the action_required state. These checks never complete, causing the PR to stay blocked, even when the merge tree is clean. This issue is tracked in docs/outstanding-issues.md as #082.

Evidence

• Example PRs (issues: close #081 after PR #1196 was closed #1220, fix(ui): harden Sheet focus handling #1217) showed repeated stalls on bot-synced heads, which blocked merging even after multiple syncs.
• Replacing bot-authored commits with agent-authored commits allowed the required checks to proceed and the PRs to be merged.

Current Mitigation

To unblock affected PRs:

1. Apply the skip-branch-sync label to stop further syncs.
2. Push