ci: poll Labs for release qualification status in Actions

Author: Codex Test

.github/workflows/release-qualification-dispatch.yml

@@ -20,8 +20,10 @@ concurrency:
 
 jobs:
   dispatch-release-qualification:
+    name: Release Qualification
     if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Build dispatch payload
         env:
@@ -95,6 +97,7 @@ jobs:
 
           RUN_ID="$(jq -r '.run.runId // empty' "${RESPONSE_FILE}")"
           RUN_STATUS="$(jq -r '.run.status // empty' "${RESPONSE_FILE}")"
+          RUN_STATUS_MESSAGE="$(jq -r '.run.statusMessage // empty' "${RESPONSE_FILE}")"
           CREATED="$(jq -r '.created // false' "${RESPONSE_FILE}")"
 
           if [[ -z "${RUN_ID}" || -z "${RUN_STATUS}" ]]; then
@@ -103,14 +106,98 @@ jobs:
             exit 1
           fi
 
+          RUN_STATUS_URL="${LABS_RELEASE_QUALIFICATION_URL%/}/${RUN_ID}"
+
           echo "run_id=${RUN_ID}" >> "${GITHUB_OUTPUT}"
           echo "run_status=${RUN_STATUS}" >> "${GITHUB_OUTPUT}"
+          echo "run_status_message=${RUN_STATUS_MESSAGE}" >> "${GITHUB_OUTPUT}"
+          echo "run_status_url=${RUN_STATUS_URL}" >> "${GITHUB_OUTPUT}"
           echo "created=${CREATED}" >> "${GITHUB_OUTPUT}"
 
+      - name: Wait for Labs release qualification result
+        id: await
+        env:
+          INITIAL_RUN_STATUS: ${{ steps.dispatch.outputs.run_status }}
+          INITIAL_RUN_STATUS_MESSAGE: ${{ steps.dispatch.outputs.run_status_message }}
+          LABS_RELEASE_QUALIFICATION_TOKEN: ${{ secrets.LABS_RELEASE_QUALIFICATION_TOKEN }}
+          RUN_STATUS_URL: ${{ steps.dispatch.outputs.run_status_url }}
+        run: |
+          set -euo pipefail
+
+          RUN_STATUS="${INITIAL_RUN_STATUS}"
+          RUN_STATUS_MESSAGE="${INITIAL_RUN_STATUS_MESSAGE}"
+
+          while [[ "${RUN_STATUS}" == "queued" || "${RUN_STATUS}" == "in_progress" ]]; do
+            RESPONSE_FILE="$(mktemp)"
+            set +e
+            HTTP_STATUS="$(curl \
+              --fail-with-body \
+              --silent \
+              --show-error \
+              --output "${RESPONSE_FILE}" \
+              --write-out '%{http_code}' \
+              -H "x-labs-internal-token: ${LABS_RELEASE_QUALIFICATION_TOKEN}" \
+              "${RUN_STATUS_URL}")"
+            CURL_EXIT=$?
+            set -e
+
+            if [[ "${CURL_EXIT}" -ne 0 ]]; then
+              cat "${RESPONSE_FILE}"
+              exit "${CURL_EXIT}"
+            fi
+
+            if [[ "${HTTP_STATUS}" -lt 200 || "${HTTP_STATUS}" -ge 300 ]]; then
+              cat "${RESPONSE_FILE}"
+              exit 1
+            fi
+
+            RUN_STATUS="$(jq -r '.run.status // empty' "${RESPONSE_FILE}")"
+            RUN_STATUS_MESSAGE="$(jq -r '.run.statusMessage // empty' "${RESPONSE_FILE}")"
+
+            if [[ -z "${RUN_STATUS}" ]]; then
+              cat "${RESPONSE_FILE}"
+              echo "Labs run lookup did not include a terminal status." >&2
+              exit 1
+            fi
+
+            if [[ "${RUN_STATUS}" == "queued" || "${RUN_STATUS}" == "in_progress" ]]; then
+              sleep 10
+            fi
+          done
+
+          echo "run_status=${RUN_STATUS}" >> "${GITHUB_OUTPUT}"
+          echo "run_status_message=${RUN_STATUS_MESSAGE}" >> "${GITHUB_OUTPUT}"
+
+      - name: Enforce Labs release qualification result
+        env:
+          FINAL_RUN_STATUS: ${{ steps.await.outputs.run_status }}
+          FINAL_RUN_STATUS_MESSAGE: ${{ steps.await.outputs.run_status_message }}
+        run: |
+          set -euo pipefail
+
+          case "${FINAL_RUN_STATUS}" in
+            succeeded)
+              exit 0
+              ;;
+            superseded)
+              echo "${FINAL_RUN_STATUS_MESSAGE:-Release qualification was superseded by a newer run.}"
+              exit 0
+              ;;
+            failed|action_required)
+              echo "${FINAL_RUN_STATUS_MESSAGE:-Release qualification failed.}" >&2
+              exit 1
+              ;;
+            *)
+              echo "Unexpected Labs release qualification status: ${FINAL_RUN_STATUS}" >&2
+              exit 1
+              ;;
+          esac
+
       - name: Write workflow summary
+        if: always()
         run: |
           {
-            echo "### Release Qualification Dispatch"
+            echo "### Release Qualification"
             echo
             echo "| Field | Value |"
             echo "| --- | --- |"
@@ -119,6 +206,7 @@ jobs:
             echo "| Head branch | \`${{ github.event.pull_request.head.ref }}\` |"
             echo "| Head SHA | \`${{ github.event.pull_request.head.sha }}\` |"
             echo "| Labs run | \`${{ steps.dispatch.outputs.run_id }}\` |"
-            echo "| Labs status | \`${{ steps.dispatch.outputs.run_status }}\` |"
+            echo "| Labs status | \`${{ steps.await.outputs.run_status }}\` |"
+            echo "| Labs status message | ${{ steps.await.outputs.run_status_message || 'n/a' }} |"
             echo "| New run created | \`${{ steps.dispatch.outputs.created }}\` |"
           } >> "${GITHUB_STEP_SUMMARY}"

cicd.md

@@ -88,8 +88,8 @@ main (next) → stable (latest) → X.x (maintenance)
 **Actions**:
 
 - Sends the PR head SHA and branch metadata to the Labs release-orchestrator service
-- Lets Labs create a generic GitHub check run on that SHA
-- Does not wait on or expose any private Labs details in the repository
+- Polls Labs for the terminal release-qualification state
+- Uses the GitHub Actions job itself as the required public status check
 - Re-triggers automatically when new commits are pushed to the PR branch
 
 Only same-repository PRs dispatch to Labs. Forked PRs are intentionally skipped so private Labs credentials are never exposed to untrusted branches.
@@ -229,7 +229,7 @@ These skip semantic-release entirely — useful for re-publishing a failed platf
 
 1. Run "Promote to Stable" workflow
 2. Review the generated PR from the candidate branch into `stable`
-3. Labs receives the PR head SHA and creates the `Release Qualification` GitHub check run
+3. Labs receives the PR head SHA, records the qualification run, and the workflow job polls Labs for the terminal result
 4. If needed, resolve merge conflicts on the candidate branch and push fixes
 5. Re-run or wait for qualification on the new PR head SHA
 6. Merge the PR into `stable`