Orchestrator that finds broken renovate/dependabot PRs across Ansible devtools repos, diagnoses failures, applies safe fixes, verifies locally, pushes, and monitors CI. Composes scan-bot-prs, rebase-pr, diagnose-ci, and verify-local into a single automated workflow.
Orchestrator that finds broken renovate/dependabot PRs across Ansible devtools repos, diagnoses failures, applies safe fixes, verifies locally, pushes, and monitors CI. Composes scan-bot-prs, rebase-pr, diagnose-ci, and verify-local into a single automated workflow.
Important: Each Bash tool call starts a fresh shell. All subsequent
git commit and git push commands MUST be prefixed with:
source ~/.ansibuddy_env 2>/dev/null || true &&
Without this prefix, SSH_AUTH_SOCK is not set and git silently produces
unsigned commits. The env file also re-exports the correct git identity
to prevent ACP's default env vars from overriding the email.
Step 1 — Discover
Run td-scan-bot-prs (or skip if a specific PR was provided).
If --interactive, display the prioritized table and let the user pick.
Otherwise, auto-pick the top priority PR.
If no failing PRs found, report and stop.
Step 2 — Rebase
Run td-rebase-pr with the selected repo and PR number.
If rebase result says "CI all passing": PR is fixed. Report success,
move to next PR in the queue.
If rebase result says "N code failures": proceed to Step 3.
If rebase result says "push rejected" or "conflicts (aborted)":
skip this PR, report why, move to next PR.
Step 3 — Diagnose
Run td-diagnose-ci with the repo and PR number. Pass the failing check
names from the rebase-pr output so it skips rediscovery.
If assessment is NEEDS HUMAN REVIEW:td-diagnose-ci already posted
a comment on the PR. Skip this PR, report why, move to next PR.
If assessment is AUTO-FIXABLE: proceed to Step 4.
Step 4 — Fix
STOP CHECK — read this before doing anything
Re-read the td-diagnose-ci output. Check the Verdict field.
If Verdict is NEEDS HUMAN REVIEW: STOP. Do NOT proceed. Do NOT
apply any fix. Do NOT modify any file. Do NOT commit. Do NOT push.
Skip this PR immediately and move to the next one. This is not a
suggestion — it is a hard rule. The comment has already been posted
on the PR by td-diagnose-ci. There is nothing left to do.
If Verdict is AUTO-FIXABLE: proceed below.
4a. Scope the fix
Prefer fixing within the files the bot already changed (lockfile,
package.json, pyproject.toml).
If the fix requires touching other files (e.g., knip config, tsconfig),
keep it minimal — only what's needed to unblock the build.
Never change test assertions, CI workflow files, or source logic.
4b. Apply by category
Lockfile regeneration:
pnpm install # TypeScript
uv lock # Python
Commit the regenerated lockfile.
Formatter/linter auto-fix:
npx prek run --all-files # TypeScript
tox -e lint # Python (some linters auto-fix)
Commit any auto-formatted files.
Removing unused imports:
Read the error output, remove the specific imports listed.
Adding a type annotation on a single line:
Read the error output, add the minimal type fix.
4c. Commit
Use conventional commits:
git add <specific-files-only>
source ~/.ansibuddy_env 2>/dev/null || true && git commit -m "fix(deps): <what was fixed>
<one-line description of what broke and why>"
Never git add -A or git add ..
Step 5 — Verify locally
Run td-verify-local. This is a hard gate — if it fails, do NOT push.
If verify-local passes: proceed to Step 6.
If verify-local fails: read the failure output, fix the issue, and
run verify-local again. Max 3 local fix iterations. If still failing
after 3 attempts, skip this PR and report.
Use the returned state (OPEN / MERGED / CLOSED) in the report. Never
infer or guess the state from other signals.
Per-PR report
## PR #NUMBER — TITLE (REPO)
**PR state:** OPEN / MERGED / CLOSED (verified via gh pr view)
**Result:** Fixed / Skipped (NEEDS HUMAN REVIEW) / Skipped (conflicts) /
Skipped (push rejected) / Failed (3 attempts exhausted)
**Attempts:** N/3
**Action taken:** rebase only / lockfile regen / config fix / formatter auto-fix
### What was done
- Rebased onto main
- <commit description>
### CI Status
- lint: pass
- preflight: pass
- test (linux): pass
- ...
Final summary
## Fix Bot PRs — Run Summary
**Date:** YYYY-MM-DD HH:MM
**PRs processed:** N
**Fixed:** X
**Skipped (human review):** Y
**Skipped (other):** Z
**Failed:** W
### Fixed PRs
- ansible/vscode-ansible #2716 — lockfile regen
- ansible/molecule #4629 — rebase only
### Skipped PRs
- ansible/vscode-ansible #2672 — NEEDS HUMAN REVIEW (4 major version bumps)
- ansible/ansible-sign #115 — push rejected (fork PR)
### Failed PRs
- ansible/ansible-lint #5011 — 3 attempts exhausted (tox lint failure)
Safety rules
Never push without td-verify-local passing.
Never force-push except --force-with-lease after a rebase.
Never change test assertions — if tests fail, that's a human call.
Never change CI/workflow config files.
Never change source logic — only lockfiles, config, formatting,
unused imports, single-line type annotations.
Never merge the PR — only fix CI. Let automerge or a human
reviewer handle the merge.
Never commit secrets, tokens, or credentials.
Stage specific files only — never git add -A or git add ..
NEEDS HUMAN REVIEW = STOP. If td-diagnose-ci returns NEEDS HUMAN
REVIEW, do NOT apply any fix, modify any file, commit, or push.
The comment is already posted. Skip the PR and move to the next one.
No exceptions. No "but it's a simple fix." STOP.
Max 3 attempts per PR — prevents infinite loops.
Processing multiple PRs
When scanning all repos, process PRs in priority order (security first,
then lockfile, then single dep, then all deps). After each PR:
If fixed: move to next PR.
If skipped or failed: log the reason, move to next PR.
Continue until all failing PRs are processed or a reasonable time
limit is reached.
The orchestrator should process PRs from different repos without
assuming any shared state between them. Each PR is independent.
Cleanup
After all PRs are processed, clean up signing artifacts:
