qwen-code/.github/workflows/sdk-java-contract-open-prs.yml

name: 'SDK Java Contract Open PRs'

# The contract-version guard in sdk-java.yml checks a pull request's
# document against the base ref of the moment it ran. Nothing re-runs it
# when main later moves, so a PR that went green claiming the next version
# stays green after another PR takes that version and publishes the number
# twice once it merges; it also cannot see several open PRs claiming one
# version — 2026-10-09 had four contract-changing PRs in flight with
# 1.34.0 claimed twice (#13804, mirroring #13742). After every push to
# main that changes the contract document, this re-checks every open PR
# against main from the API's file lists and the claiming PRs' documents
# from the contents API — no PR code is fetched, checked out or run — and
# sets the 'API contract version uniqueness (latest main)' status on PR
# heads as scripts/check-contract-open-prs.js describes. The schedule
# catches up after a failed or cancelled run and reaches PRs opened,
# pushed or retargeted to main since the last one; a head whose status
# would not change is not written again.

on:
  push:
    branches:
      - 'main'
    paths:
      - 'packages/managed-agent-server/contracts/src/main/resources/openapi/managed-agent-public-api.openapi.json'
      - 'scripts/check-contract-open-prs.js'
      - 'scripts/contract-version-utils.js'
      - '.github/workflows/sdk-java-contract-open-prs.yml'
  schedule:
    - cron: '13,43 * * * *'
  workflow_dispatch:

permissions:
  contents: 'read'

# Queued, never cancelled mid-run: GitHub keeps only the newest pending run,
# and each run checks out main when it starts — a re-run included — so the
# last statuses written are those of the newest main. Keyed by ref so that a
# dispatch from another branch, whose job is skipped, cannot replace a
# pending main run.
concurrency:
  group: 'sdk-java-contract-open-prs-${{ github.ref }}'
  cancel-in-progress: false

jobs:
  recheck:
    name: 'Re-check open PRs against main'
    if: "${{ github.repository == 'QwenLM/qwen-code' && github.ref == 'refs/heads/main' }}"
    # Push, schedule and dispatch are all trusted triggers, so the ECS pool
    # (#13245): the check races the next merge. Kill-switch:
    # MAINTAINER_ECS_RUNNER_DISABLED.
    runs-on: '${{ (github.repository == ''QwenLM/qwen-code'' && vars.MAINTAINER_ECS_RUNNER_DISABLED != ''true'') && fromJSON(''["self-hosted", "linux", "x64", "ecs-qwen"]'') || fromJSON(''["ubuntu-latest"]'') }}'
    timeout-minutes: 10
    permissions:
      contents: 'read'
      pull-requests: 'read'
      statuses: 'write'
    steps:
      - name: 'Restore workspace ownership'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: |-
          set -uo pipefail
          RUNNER_UID="$(id -u)"
          RUNNER_GID="$(id -g)"
          if [ "$RUNNER_UID" != "0" ]; then
            chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chown -R "$RUNNER_UID:$RUNNER_GID" "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace ownership; checkout may fail on leftover root-owned files"
          fi
          chmod -R u+rwX "$GITHUB_WORKSPACE" 2>/dev/null || sudo -n chmod -R u+rwX "$GITHUB_WORKSPACE" || echo "::warning::could not restore workspace write permissions; checkout may fail on leftover read-only files"
          # A leftover workspace owned by a different uid than the step user
          # (e.g. a runner-user checkout under root-run steps) makes every git
          # call fail with "detected dubious ownership". The pinned
          # actions/checkout adds safe.directory only to its own temporary
          # global config, so later steps are uncovered; trust the workspace
          # here instead. The --get-all guard keeps a persistent runner's
          # gitconfig from accumulating a duplicate entry per job.
          git config --global --get-all safe.directory 2>/dev/null | grep -qxF "$GITHUB_WORKSPACE" || git config --global --add safe.directory "$GITHUB_WORKSPACE" || echo "::warning::could not mark the workspace as a git safe.directory; git steps may fail on a mismatched-ownership checkout"

      # ci.yml's pre-checkout sweep, byte-identical to the ci.yml copies
      # (pinned in scripts/tests/sdk-java-workflow.test.js): residue left by
      # review/autofix jobs on the shared ECS pool fails actions/checkout's
      # clean — the #13506 failure. Hosted legs skip it on fresh VMs.
      - name: 'Clean stale .qwen before checkout'
        if: "${{ runner.environment == 'self-hosted' }}"
        run: |-
          set -uo pipefail
          for stale_qwen in "$GITHUB_WORKSPACE/.qwen" "$GITHUB_WORKSPACE/.qwen.root-orig" "$GITHUB_WORKSPACE/trusted-ci-classifier"; do
            if [ ! -e "$stale_qwen" ] && [ ! -L "$stale_qwen" ]; then
              continue
            fi
            if [ -d "$stale_qwen" ] && [ ! -L "$stale_qwen" ]; then
              chmod -R u+w "$stale_qwen" 2>/dev/null || true
            fi
            # A foreign-owned directory cannot always be renamed to a
            # different parent: updating its .. entry can fail even when the
            # workspace parent is writable. If that individual move fails,
            # quarantine the runner-owned workspace itself, then recreate the
            # empty checkout root. Warm contents are lost only on this
            # otherwise unrecoverable path.
            rm -rf -- "$stale_qwen" 2>/dev/null ||
              sudo -n rm -rf -- "$stale_qwen" 2>/dev/null ||
              {
                quarantine="$(dirname -- "$GITHUB_WORKSPACE")/_qwen-quarantine"
                mkdir -p "$quarantine" 2>/dev/null || true
                stale_name="$(basename -- "$stale_qwen")"
                if mv -- "$stale_qwen" "$quarantine/${stale_name#\.}-$(date -u +%Y%m%dT%H%M%SZ)-$$" 2>/dev/null; then
                  echo "::warning::could not delete leaked $stale_name; moved it to $quarantine so this checkout can proceed — that directory needs manual cleanup"
                else
                  workspace_quarantine="$quarantine/workspace-$(date -u +%Y%m%dT%H%M%SZ)-$$"
                  if mv -- "$GITHUB_WORKSPACE" "$workspace_quarantine" 2>/dev/null &&
                     mkdir -p "$GITHUB_WORKSPACE" 2>/dev/null &&
                     cd "$GITHUB_WORKSPACE"; then
                    echo "::warning::could not delete leaked $stale_name; moved the whole workspace to $workspace_quarantine so this checkout can proceed — that directory needs manual cleanup"
                    break
                  else
                    echo "::warning::leaked $stale_name survived every recovery; runner needs manual cleanup"
                  fi
                fi
              }
          done
          # Interrupted reviews leave worktree registrations under .qwen/tmp/
          # and qwen-review/* branches behind. prune drops registrations whose
          # directories the rm above removed; worktree remove --force then
          # clears any still-registered leftover directory (--force tolerates
          # dirty contents), since a branch checked out in a live worktree
          # cannot be deleted. If removal still fails, the registration
          # survives and the branch delete below warns. The sweep deletes all
          # review artifacts, not just the current PR's: safe because a runner
          # executes one job at a time. Kept inline rather than a shared
          # script: this runs pre-checkout on shared runners, where leftover
          # workspace files are untrusted.
          if [ -e "$GITHUB_WORKSPACE/.git" ]; then
            GIT_SAFE=(git -c core.hooksPath=/dev/null -c core.fsmonitor= -C "$GITHUB_WORKSPACE")
            "${GIT_SAFE[@]}" worktree prune -v || true
            "${GIT_SAFE[@]}" worktree list --porcelain \
              | awk '$1 == "worktree" && index($0, "/.qwen/tmp/review-pr-") > 0 { sub(/^worktree /, ""); print }' \
              | while read -r worktree; do
                  [ -n "$worktree" ] || continue
                  # Registered paths come from leftover git metadata and are
                  # untrusted: the awk filter above matched by substring, so reject
                  # `..` traversal and re-anchor to the review prefix before the
                  # destructive remove.
                  case "$worktree" in
                    */../*|../*|*/..)
                      echo "::warning::skipping suspicious review worktree path: $worktree"
                      continue
                      ;;
                    "$GITHUB_WORKSPACE/.qwen/tmp/review-pr-"*) : ;;
                    *)
                      echo "::warning::skipping unexpected review worktree path: $worktree"
                      continue
                      ;;
                  esac
                  "${GIT_SAFE[@]}" worktree remove --force "$worktree" ||
                    echo "::warning::could not remove review worktree: $worktree"
                done || true
            "${GIT_SAFE[@]}" worktree prune -v || true
            "${GIT_SAFE[@]}" for-each-ref --format='%(refname:short)' 'refs/heads/qwen-review/*' \
              | while read -r stale_ref; do
                  if [ -n "$stale_ref" ]; then
                    "${GIT_SAFE[@]}" branch -D "$stale_ref" ||
                      echo "::warning::could not remove review branch: $stale_ref"
                  fi
                done || true
          fi

      - name: 'Checkout'
        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
        with:
          ref: 'main'
          persist-credentials: false

      - name: 'Re-check open pull requests'
        env:
          GH_TOKEN: '${{ github.token }}'
        run: 'node scripts/check-contract-open-prs.js'