Repository navigation
fix(pr-pipeline): close admissions when check-wip-cap cannot load its config #9121
Description
Problem
check-wip-cap silently drops its caps when its config dependency breaks. .github/actions/check-wip-cap/check-wip-cap.mjs:282-290 turns a failed import of resolve-config into the default limits with only a warning, and action.yml:75-76 turns a failed npm ci into a warning. A broken dependency therefore takes the caps off, and work-unblock can admit without limit, the same shape as the 2026-10-22 incomplete-search incident (#9089), triggered by a dependency instead of the API. Found by Security & Cost while passing #9120.
Fix
A failed resolve-config import or dependency install keeps the last saved state (as run pauses already do through keepLastState), or sets admission room to 0 with reason config-unreadable and a named ::warning. Run pauses stay as they are. Basis: #9089's owner-approved rule that an unknown read closes admissions.
Activity
github-actions commentedon Oct 22, 2026
Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.
Size: Small
Complexity: Low
Uncertainty: Known
Flags: none
Blocked by: none
#9121 (comment)
The decision settles the open questions: close admissions with
config-unreadable, keepnpm cinon-fatal with a reworded warning, update the action.yml description, and add a unit test. No duplicates found. This is a bounded fix to check-wip-cap and its action.yml, so no further questions.Automated triage, applied by the lanes App.
kyle-sexton commentedon Oct 25, 2026
Released for re-triage under the owner's 2026-10-24 rule: an issue stops for a person only for an intent or vision question, a security call, a host or attended run, or spend outside prepaid credit. The hold label came off and intake triage runs again now; it re-applies a hold, with a numbered question, when one of those applies.
To hold this issue again, add
needs-human(orstatus: needs-decision) and say why in a comment.melodic-automation-lanes commentedon Oct 25, 2026
Not admitted to the issue lane: no trusted-human acceptance criteria: a listed human must put the confirmed
- [ ]criteria in the body or post them as their own comment, or, on an issue a listed human filed, intake's newest refinement comment must hold them unedited. Admission takes the issue once each of those is met, when intake triages it again (.github/actions/resolve-config/admission-rules.json).melodic-automation-lanes commentedon Oct 25, 2026
The latest triage verdict holds nothing: the issue is at
status: ready.melodic-automation-lanes commentedon Oct 25, 2026
Refinement. A read-only run explored this repository, searched its issues and pull requests, and read the allowed docs to draft what follows. On an issue a listed human filed, it counts as the issue's spec once posted, while unedited; it is still model text, so check it.
Intended outcome: When check-wip-cap cannot read the base config (failed resolve-config import or failed npm ci), admissions close with admission_reason config-unreadable and a named warning, while run pauses keep their last-state behavior.
Related work
Open questions
RECOMMENDED: Set admission room to 0 with admission_reason config-unreadable and a named ::warning. keepLastState saves only the pause, not admission fields, so keeping last state would need new state handling, while closing matches the unknown-read-closes rule and is simpler to check. Basis: .github/actions/check-wip-cap/check-wip-cap.mjs:300
RECOMMENDED: Yes to a config-unreadable admission_basis; keep npm ci non-fatal with its warning reworded, since the import failure in baseConfig then sets configError and closes admissions, keeping one code path. Basis: .github/actions/check-wip-cap/action.yml:76
RECOMMENDED: Yes: update both descriptions and add a unit test where baseConfig fails and asserts admission_open false, admission_reason config-unreadable. Basis: .github/actions/check-wip-cap/action.yml:40
Sources read
Automated refinement by the lanes App. Answer with a comment whose first line is
**Decision recorded.**.kyle-sexton commentedon Oct 26, 2026
Decision recorded. The owner answered in the Issue Triage session (2026-10-25), accepting the recommended answers below:
Question asked: On a config read failure, close admissions (room 0, reason
config-unreadable) rather than keep the last saved state?Accepted: Close: admission room 0,
admission_reasonconfig-unreadable, a named::warning. keepLastState keeps onlypausedandpause_reason, so "keep last state" would need new state handling; closing matches the body's cited fix(pr-pipeline): treat an incomplete GitHub search as unknown #9089 rule that an unknown read closes admissions. Basis: kept; .github/actions/check-wip-cap/check-wip-cap.mjs:300-310 (keepLastState), :215-221 (room is 0 only for an incomplete or truncated search), :318-327 (baseConfig falls back to defaults).config-unreadabletoadmission_basis; should a failednpm cifail the step?Accepted: Yes to the basis value. Keep
npm cinon-fatal with a reworded warning: the import then fails, setsconfigError, and closes admissions through one code path. Basis: kept; check-wip-cap.mjs:257 (admission_basis), action.yml:76-77.Accepted: Yes. Update the action.yml text that says a failed read leaves
true, and add a unit test where baseConfig fails. Basis: kept; action.yml:40.Acceptance criteria:
admission_openfalse,admission_reasonconfig-unreadable,admission_basisconfig-unreadable, and a named::warning.npm cistill continues, and its warning says admissions close.admission-opendescription states the config-unreadable case.