fix(worker): comment on the head an autofix run published, not the trigger sha

Author: outof-place

apps/worker/src/workflows/blocks/post-pr-comment.test.ts

@@ -253,6 +253,86 @@ describe("post_pr_comment execute", () => {
     expect(result.kind).toBe("next");
   });
 
+  function finalizedWithoutPr(pushedHead: string): WorkspacePublicationResult {
+    // What a remediation graph really produces: the branch was finalized, but no
+    // pull request was opened because the pull request already existed.
+    return {
+      status: "finalized",
+      prs: [],
+      repositories: [
+        {
+          provider: "github",
+          repoPath: "acme/api",
+          branchName: "blazebot/awt-1",
+          defaultBranch: "main",
+          expectedHead: "abc123",
+          pushedHead,
+        },
+      ],
+    };
+  }
+
+  function prTriggerEntry() {
+    return {
+      kind: "pr_trigger" as const,
+      triggerType: "trigger_pr_checks_failed" as const,
+      subjectKey: "ticket:jira:AWT-1",
+      ticketKey: "AWT-1",
+      ownerToken: "owner:test",
+      definitionId: 1,
+      definitionVersion: 1,
+      scope: "workflow_owned" as const,
+      pr: makePrPayload(),
+    };
+  }
+
+  it("comments on the head this run published, not the sha the trigger recorded", async () => {
+    const postPRComment = vi.fn().mockResolvedValue({ url: "https://pr/comment" });
+    mocks.createRepositoryVCS.mockReturnValue({
+      getPRHead: vi
+        .fn()
+        .mockResolvedValue({ headSha: "pushed-by-this-run", baseRef: "main", state: "open" }),
+      postPRComment,
+    });
+
+    const result = await execute(
+      makeNode("post_pr_comment", { body: "Automated fix pushed." }),
+      {},
+      makeCtx({
+        entry: prTriggerEntry(),
+        publication: finalizedWithoutPr("pushed-by-this-run"),
+      }),
+    );
+
+    expect(postPRComment).toHaveBeenCalledWith(7, marked("Automated fix pushed."));
+    expect(result.kind).toBe("next");
+  });
+
+  it("still refuses to comment when somebody else moved the head", async () => {
+    const postPRComment = vi.fn().mockResolvedValue({ url: "https://pr/comment" });
+    mocks.createRepositoryVCS.mockReturnValue({
+      getPRHead: vi
+        .fn()
+        .mockResolvedValue({ headSha: "someone-else", baseRef: "main", state: "open" }),
+      postPRComment,
+    });
+
+    const result = await execute(
+      makeNode("post_pr_comment", { body: "Automated fix pushed." }),
+      {},
+      makeCtx({
+        entry: prTriggerEntry(),
+        publication: finalizedWithoutPr("pushed-by-this-run"),
+      }),
+    );
+
+    expect(postPRComment).not.toHaveBeenCalled();
+    expect(result).toMatchObject({
+      kind: "execution_error",
+      error: expect.objectContaining({ message: expect.stringContaining("stale PR/MR head") }),
+    });
+  });
+
   it.each([
     {
       current: { headSha: "new-head", baseRef: "main", state: "open" as const },

apps/worker/src/workflows/blocks/post-pr-comment.ts

@@ -166,13 +166,28 @@ export const execute: BlockExecuteFn = async (
       });
     }
   } else if (ctx.entry.kind === "pr_trigger") {
+    // Publication reports `prs` only when it opened one, so a graph that
+    // remediates an existing pull request always lands here rather than in the
+    // branch above. Its head is still this run's own work: a fix agent commits
+    // AND pushes from inside the sandbox, which is what makes CI re-run. Taking
+    // the sha the trigger recorded would compare the comment against a head this
+    // same run superseded and refuse to post on every successful fix. Publication
+    // already proved that head is ours, so prefer what it finalized, and keep the
+    // trigger sha for a run that published nothing. A foreign push still fails
+    // the comparison below and still stops the comment.
+    const finalized = ctx.publication?.repositories.find(
+      (repository) =>
+        ctx.entry.kind === "pr_trigger" &&
+        repository.provider === ctx.entry.pr.provider &&
+        repository.repoPath === ctx.entry.pr.repoPath,
+    );
     prs = [
       {
         provider: ctx.entry.pr.provider,
         repoPath: ctx.entry.pr.repoPath,
         baseBranch: ctx.entry.pr.baseRef,
         prId: ctx.entry.pr.prNumber,
-        expectedHead: ctx.entry.pr.headSha,
+        expectedHead: finalized?.pushedHead ?? ctx.entry.pr.headSha,
         expectedState: ctx.entry.triggerType === "trigger_pr_merged" ? "merged" : "open",
       },
     ];