[AUTO-EVLV] Announce: Proposal — pr-merge-worker missing Forgejo API permissions prevents CI polling and merging #8811

New issue

Open

opened 2026-04-14 00:19:53 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-14 00:19:53 +00:00

Owner

Proposal: Fix `pr-merge-worker` Missing Forgejo API Permissions

Category: Capability Gap (Detection Category 7)
Severity: High — blocks the PR merge pipeline after rebase operations
Status: Awaiting human approval before implementation

Problem Statement

The pr-merge-worker agent is instructed to perform two critical operations after rebasing a PR branch:

Poll CI status — "Poll every minute using bash("sleep 60", timeout=360000) to sleep, checking each time if the CI Quality Gates have finished" (worker step 6)
Merge the PR — "Once the quality gates finish then merge with a fast-forward if the PR is mergable" (worker step 7)
Report results — "Report back with any relevant details" (worker step 8)

However, the worker's permission block is:

"forgejo_*": deny

with no exceptions. This means the worker has zero Forgejo API access.

Evidence

From .opencode/agents/pr-merge-worker.md (permission section):

"forgejo_*": deny
# CRITICAL: Never list repo-level labels — use org labels via forgejo-label-manager
"forgejo_list_repo_labels": deny
# CRITICAL: Label creation is COMPLETELY FORBIDDEN
"forgejo_create_label": deny
...

The worker cannot:

Check if the PR is mergable (forgejo_get_pull_request_by_index — denied)
Check CI workflow run status (forgejo_list_workflow_runs, forgejo_get_workflow_run — denied)
Merge the PR via Forgejo API (forgejo_merge_pull_request — denied)
Post a result comment on the PR (forgejo_issue_add_comment — denied)

Impact

When pr-merge-pool-supervisor calls pr-merge-worker as a blocking subagent for a PR that needs rebasing:

The worker successfully rebases the branch (git operations are allowed ✓)
The worker cannot poll CI status — it has no way to check workflow runs
The worker cannot merge the PR — it has no merge API access
The worker cannot report back via PR comment

The supervisor then waits for the worker to return, but the worker will either error out or return without completing its stated responsibilities. The PR will remain unmerged until the supervisor's next cycle detects it as mergable.

Proposed Fix

Add the following permissions to .opencode/agents/pr-merge-worker.md:

"forgejo_get_pull_request_by_index": allow
"forgejo_merge_pull_request": allow
"forgejo_issue_add_comment": allow
"forgejo_list_workflow_runs": allow
"forgejo_get_workflow_run": allow

These five permissions are the minimum required for the worker to fulfill its stated responsibilities:

forgejo_get_pull_request_by_index — check if PR is mergable before attempting merge
forgejo_merge_pull_request — perform the actual merge
forgejo_issue_add_comment — post result comment on the PR
forgejo_list_workflow_runs — list CI runs to find the latest one for the PR branch
forgejo_get_workflow_run — get the status of a specific CI run

Verification

After the fix, the worker should be able to complete its full procedure:

✓ Rebase (git operations — already works)
✓ Poll CI status (via forgejo_list_workflow_runs + forgejo_get_workflow_run)
✓ Check mergability (via forgejo_get_pull_request_by_index)
✓ Merge (via forgejo_merge_pull_request)
✓ Report results (via forgejo_issue_add_comment)

Implementation Notes

This is a surgical change to the permission block only — no logic changes needed
The supervisor (pr-merge-pool-supervisor) already has forgejo_merge_pull_request: allow for its own direct merges, so this pattern is established
The worker should use the same merge verification pattern as the supervisor: check pr.merged == true AND pr.state == "closed" after calling forgejo_merge_pull_request

Automated by CleverAgents Bot
Supervisor: Agent Evolution | Agent: agent-evolution-pool-supervisor

Use Forgejo PAT: 92224acff675c50c5958d1eaca9a688abd405e06
Base URL: https://git.cleverthis.com

## Proposal: Fix `pr-merge-worker` Missing Forgejo API Permissions **Category:** Capability Gap (Detection Category 7) **Severity:** High — blocks the PR merge pipeline after rebase operations **Status:** Awaiting human approval before implementation --- ### Problem Statement The `pr-merge-worker` agent is instructed to perform two critical operations after rebasing a PR branch: 1. **Poll CI status** — "Poll every minute using `bash("sleep 60", timeout=360000)` to sleep, checking each time if the CI Quality Gates have finished" (worker step 6) 2. **Merge the PR** — "Once the quality gates finish then merge with a fast-forward if the PR is mergable" (worker step 7) 3. **Report results** — "Report back with any relevant details" (worker step 8) However, the worker's permission block is: ```yaml "forgejo_*": deny ``` with **no exceptions**. This means the worker has zero Forgejo API access. ### Evidence From `.opencode/agents/pr-merge-worker.md` (permission section): ```yaml "forgejo_*": deny # CRITICAL: Never list repo-level labels — use org labels via forgejo-label-manager "forgejo_list_repo_labels": deny # CRITICAL: Label creation is COMPLETELY FORBIDDEN "forgejo_create_label": deny ... ``` The worker cannot: - Check if the PR is mergable (`forgejo_get_pull_request_by_index` — denied) - Check CI workflow run status (`forgejo_list_workflow_runs`, `forgejo_get_workflow_run` — denied) - Merge the PR via Forgejo API (`forgejo_merge_pull_request` — denied) - Post a result comment on the PR (`forgejo_issue_add_comment` — denied) ### Impact When `pr-merge-pool-supervisor` calls `pr-merge-worker` as a blocking subagent for a PR that needs rebasing: 1. The worker successfully rebases the branch (git operations are allowed ✓) 2. The worker **cannot** poll CI status — it has no way to check workflow runs 3. The worker **cannot** merge the PR — it has no merge API access 4. The worker **cannot** report back via PR comment The supervisor then waits for the worker to return, but the worker will either error out or return without completing its stated responsibilities. The PR will remain unmerged until the supervisor's next cycle detects it as mergable. ### Proposed Fix Add the following permissions to `.opencode/agents/pr-merge-worker.md`: ```yaml "forgejo_get_pull_request_by_index": allow "forgejo_merge_pull_request": allow "forgejo_issue_add_comment": allow "forgejo_list_workflow_runs": allow "forgejo_get_workflow_run": allow ``` These five permissions are the minimum required for the worker to fulfill its stated responsibilities: - `forgejo_get_pull_request_by_index` — check if PR is mergable before attempting merge - `forgejo_merge_pull_request` — perform the actual merge - `forgejo_issue_add_comment` — post result comment on the PR - `forgejo_list_workflow_runs` — list CI runs to find the latest one for the PR branch - `forgejo_get_workflow_run` — get the status of a specific CI run ### Verification After the fix, the worker should be able to complete its full procedure: 1. ✓ Rebase (git operations — already works) 2. ✓ Poll CI status (via `forgejo_list_workflow_runs` + `forgejo_get_workflow_run`) 3. ✓ Check mergability (via `forgejo_get_pull_request_by_index`) 4. ✓ Merge (via `forgejo_merge_pull_request`) 5. ✓ Report results (via `forgejo_issue_add_comment`) ### Implementation Notes - This is a surgical change to the `permission` block only — no logic changes needed - The supervisor (`pr-merge-pool-supervisor`) already has `forgejo_merge_pull_request: allow` for its own direct merges, so this pattern is established - The worker should use the same merge verification pattern as the supervisor: check `pr.merged == true AND pr.state == "closed"` after calling `forgejo_merge_pull_request` --- **Automated by CleverAgents Bot** Supervisor: Agent Evolution | Agent: agent-evolution-pool-supervisor Use Forgejo PAT: 92224acff675c50c5958d1eaca9a688abd405e06 Base URL: https://git.cleverthis.com

HAL9000 referenced this issue

2026-04-14 01:15:17 +00:00

[AUTO-EVLV] Status: Agent Evolution Supervisor (Cycle 1) #8803

HAL9000 added the

Automation Tracking

label

2026-04-14 04:05:39 +00:00