[build] update open bot PRs in place through a shared workflow so fixes pushed to them survive the next run by titusfortner · Pull Request #18197 · SeleniumHQ/selenium

titusfortner · 2026-10-18T17:17:03Z

🔗 Related Issues

[build] Automated Browser Version Update (major) #18160 — the daily browser update overwrote the guard fix pushed to this PR twice before it could merge
[Feature Request] Do not overwrite existing pull request if the branch has been touched by others peter-evans/create-pull-request#4161 — open request for this behavior; the maintainer considers rebuilding the branch deliberate

💥 What does this PR do?

The scheduled browser, CDDL, and dependency update workflows now add each update as a new commit on the open PR's branch instead of rebuilding it from trunk, so fixes pushed to those PRs survive the next run.

🔧 Implementation Notes

create-pull-request always rebuilds the PR branch from the base and force-pushes, so a shared update-pr.yml replaces it with git push plus gh pr create/gh pr edit.
Whether the bot branch exists decides where the update runs: delete_branch_on_merge is on, so after a PR merges the next update starts from trunk again.
The browser (major) and with CDP title markers now compare against trunk instead of HEAD, so they persist when updates stack on the PR; the title is refreshed whenever an update is pushed.
The update command runs with contents: read; only the publish job gets write access.
A bot PR closed without merging needs its branch deleted, or the next run updates that branch without opening a new PR.

🤖 AI assistance

AI assisted (complete below)
- Tool(s): Claude Code (Opus 5.5)
- What was generated: the workflow changes, the create-pull-request source analysis, and this description
- I reviewed all AI output and can explain the change

🔄 Types of changes

Bug fix (CI workflows only)

…es pushed to them survive the next run

selenium-ci · 2026-10-18T17:17:12Z

/agentic_describe

selenium-ci · 2026-10-18T17:17:13Z

/agentic_review

qodo-code-review · 2026-10-18T17:17:43Z

PR Summary by Qodo

Preserve fixes on open automated update PRs

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Stack scheduled browser, CDDL, and dependency updates onto existing bot branches instead of
 replacing them.
• Share branch publishing logic and limit update jobs to read-only repository access.
• Keep browser PR title markers accurate against trunk as updates accumulate.

Diagram

graph TD
  Sources["Scheduled workflows"] --> Branch{"Branch exists?"} -->|Yes| Existing["Bot branch"] --> Update["Bazel updater"] --> Patch["Patch artifact"] --> Publish["Publish job"] --> PR["GitHub PR"]
  Branch -->|No| Trunk["Trunk"] --> Update

High-Level Assessment

The shared workflow fits three nearly identical update paths while avoiding create-pull-request's branch rebuild behavior. Retaining that action would not preserve fixes pushed to an open bot branch; separate publishing implementations would duplicate the same branch and PR handling.

Files changed (5) +117 / -148

Bug fix (5) +117 / -148

dependency-updates.ymlRoute dependency updates through shared PR publishing +12/-45

Route dependency updates through shared PR publishing
• Replaces the separate Bazel and create-PR jobs with the shared workflow, passing the dependency command, branch, title, body, and token. Failure notification now depends on the single reusable-workflow job.
.github/workflows/dependency-updates.yml

pin-browsers.ymlRoute browser updates through shared PR publishing +10/-42

Route browser updates through shared PR publishing
• Replaces patch application and create-pull-request with the shared workflow. The PR body now explains the persistent major-version and CDP title markers.
.github/workflows/pin-browsers.yml

update-cddl.ymlRoute CDDL updates through shared PR publishing +15/-50

Route CDDL updates through shared PR publishing

• Moves CDDL generation into the shared workflow and retains the projected-schema gate by discarding changes when schema.json is unchanged. Failure notification now depends on the single reusable-workflow job.

.github/workflows/update-cddl.yml

update-pr.ymlAdd shared workflow for in-place bot PR updates +69/-0

Add shared workflow for in-place bot PR updates

• Runs update commands against an existing bot branch when present, then transfers their patch to a separate publish job. Publishing commits and pushes without rebuilding the branch, and creates or retitles the PR; the update job has read-only contents access.

.github/workflows/update-pr.yml

update_browsers.shDerive browser PR title markers from trunk +11/-11

Derive browser PR title markers from trunk

• Compares pinned browser majors and the Chrome DevTools directory against trunk so title markers remain accurate when updates stack on a bot branch. Emits the title-ready “(major)” and “with CDP” suffixes.

scripts/github-actions/update_browsers.sh

qodo-code-review · 2026-10-18T17:19:56Z

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. ~~Failed spec updates can publish partial work~~ ✗ Dismissed

Description

The new CDDL command runs ./go update_cddl before a separate if command without making the
update's failure terminate the enclosing Bazel step. Because Bazel executes that multiline input on
the left side of a tee pipeline, a successful final if can mask an update failure, allowing its
partial changes to be saved as a patch and published.

Code

.github/workflows/update-cddl.yml[R21-22]

+        ./go update_cddl
+        if git diff --quiet -- common/bidi/schema.json; then git reset -q --hard; fi

Evidence
The added input has two commands; Bazel places them in a command group piped to tee, where an
earlier failure need not terminate execution. Its diff-saving step stages changes even after
failures, and the new publish job checks only that the patch exists before pushing it.
.github/workflows/update-cddl.yml[19-23]
.github/workflows/bazel.yml[244-253]
.github/workflows/bazel.yml[291-303]
.github/workflows/update-pr.yml[51-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The CDDL updater's failure can be masked by the following cleanup command, allowing partial generated changes to reach the bot PR.

## Fix Focus Areas
- .github/workflows/update-cddl.yml[20-22]
- .github/workflows/bazel.yml[244-249]

## Recommended Fix
Make the CDDL command explicitly propagate a nonzero exit before the schema check, for example with `./go update_cddl || exit $?`. Ensure the enclosing logged Bazel execution preserves failures from each command in multiline inputs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. Manual runs can include unrelated changes 🐞 Bug ≡ Correctness

Description

update-pr.yml ignores a missing bot branch and leaves both jobs on their initial checkout instead
of explicitly checking out trunk. If someone starts a manual update from another branch after the
bot branch has been deleted, the publish job creates the bot branch from that selected branch and
opens a pull request containing its unrelated commits.

Code

.github/workflows/update-pr.yml[65]

+          git fetch --no-tags --depth=1 origin "$BRANCH" && git checkout -q FETCH_HEAD || true

Evidence
The caller allows manual dispatch, while Bazel checks out the event ref when no ref input is
supplied. The shared workflow supplies no ref and suppresses a missing-branch fetch in both jobs;
its publish checkout likewise defaults to the event ref, which it then pushes as the new bot branch.
.github/workflows/dependency-updates.yml[3-7]
.github/workflows/bazel.yml[125-130]
.github/workflows/update-pr.yml[31-35]
.github/workflows/update-pr.yml[47-50]
.github/workflows/update-pr.yml[65-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A manual run from a non-trunk ref can create a bot PR containing that ref's unrelated commits when the bot branch does not exist.

## Fix Focus Areas
- .github/workflows/update-pr.yml[34-34]
- .github/workflows/update-pr.yml[65-68]

## Recommended Fix
In both jobs, check out the bot branch if it exists and explicitly check out trunk if it does not. Do not treat other fetch or checkout failures as an absent branch; fail the job instead.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

3. ~~Open spec requests miss later pin updates~~ ✗ Dismissed

Description

The CDDL command resets every regenerated file when schema.json is unchanged relative to the
checked-out bot branch. If an open CDDL PR already contains a schema change and a later run advances
its pins without changing that branch's schema again, the reset discards those pins instead of
adding them to the PR.

Code

.github/workflows/update-cddl.yml[22]

+        if git diff --quiet -- common/bidi/schema.json; then git reset -q --hard; fi

Evidence
The shared workflow checks out the existing bot branch before running the caller's command. The CDDL
caller tests the working-tree diff against that checkout and resets all resulting changes when the
schema is unchanged; the shared Bazel workflow builds its publishable patch only from changes
remaining afterward.
.github/workflows/update-pr.yml[31-35]
.github/workflows/update-cddl.yml[19-23]
.github/workflows/bazel.yml[291-307]
scripts/update_cddl.py[32-36]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
An existing CDDL PR can already have a schema change while a later update changes only its pins. Comparing the working tree to the PR branch then discards that later update.
## Fix Focus Areas
- .github/workflows/update-cddl.yml[20-22]
- .github/workflows/update-pr.yml[34-34]
## Recommended Fix
Decide whether the regenerated schema differs from trunk, while retaining updates made relative to the existing bot branch. Do not hard-reset a pin update merely because the schema is unchanged relative to that branch.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

4. ~~Overlapping runs leave updates unpublished~~ ✗ Dismissed

Description

The publish job pushes to a fixed bot branch without coordinating with other runs of the same update
workflow or retrying a rejected push. If two scheduled or manually dispatched runs fetch the same
branch tip, the first push advances it and the second fails as non-fast-forward, leaving that run's
generated update unpublished.

Code

.github/workflows/update-pr.yml[R65-68]

+          if git fetch --no-tags --depth=1 origin "$BRANCH"; then git checkout -q FETCH_HEAD; fi
+          git apply --index changes.patch
+          git -c user.name="Selenium CI Bot" -c user.email="selenium-ci@users.noreply.github.com" commit -qm "$TITLE"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GH_REPO}.git" HEAD:refs/heads/"$BRANCH"

Evidence
The update and publish jobs fetch the branch separately, and publishing uses an ordinary push with
no retry. Each caller supplies a fixed branch name and permits both scheduled and manual runs, so
two runs of one caller can overlap on the same destination.
.github/workflows/update-pr.yml[26-40]
.github/workflows/update-pr.yml[64-69]
.github/workflows/dependency-updates.yml[1-5]
.github/workflows/dependency-updates.yml[19-22]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Overlapping runs can prepare commits against the same fixed bot-branch tip. One push succeeds and the other is rejected without publishing its update.
## Fix Focus Areas
- .github/workflows/update-pr.yml[26-40]
- .github/workflows/update-pr.yml[65-69]
## Recommended Fix
Serialize complete update-and-publish runs by bot branch without canceling an in-progress publish, or refetch and regenerate/reapply the update after a non-fast-forward rejection.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

❌ Tickets: failed to load — Ticket collection could not establish complete evidence

✅ Web pages:

🌐 actions/download-artifact

🌐 [bug] v4: Breaking change: 0 download artifacts downloaded now exits with failure · Issue #251 · actions/download-artifact

🌐 docs/MIGRATION.md

+16 more

Review mode: Auto: ⚖️ Balanced: Shared CI publishing workflow has real branch, permission, and failure-handling risks.

Tip of the day

💡 Did you know, you can move or hide resolved findings to focus on what still needs action

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Previous reviews

Review updated until commit 54ded1b

Results up to commit 9315d80 ⚖️ Balanced

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Manual runs can include unrelated changes 🐞 Bug ≡ Correctness

Description

update-pr.yml ignores a missing bot branch and leaves both jobs on their initial checkout instead
of explicitly checking out trunk. If someone starts a manual update from another branch after the
bot branch has been deleted, the publish job creates the bot branch from that selected branch and
opens a pull request containing its unrelated commits.

Code

.github/workflows/update-pr.yml[65]

+          git fetch --no-tags --depth=1 origin "$BRANCH" && git checkout -q FETCH_HEAD || true

Evidence
The caller allows manual dispatch, while Bazel checks out the event ref when no ref input is
supplied. The shared workflow supplies no ref and suppresses a missing-branch fetch in both jobs;
its publish checkout likewise defaults to the event ref, which it then pushes as the new bot branch.
.github/workflows/dependency-updates.yml[3-7]
.github/workflows/bazel.yml[125-130]
.github/workflows/update-pr.yml[31-35]
.github/workflows/update-pr.yml[47-50]
.github/workflows/update-pr.yml[65-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
A manual run from a non-trunk ref can create a bot PR containing that ref's unrelated commits when the bot branch does not exist.

## Fix Focus Areas
- .github/workflows/update-pr.yml[34-34]
- .github/workflows/update-pr.yml[65-68]

## Recommended Fix
In both jobs, check out the bot branch if it exists and explicitly check out trunk if it does not. Do not treat other fetch or checkout failures as an absent branch; fail the job instead.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Dismiss ↗ | View ↗

2. ~~Failed spec updates can publish partial work~~ ✗ Dismissed

Description

The new CDDL command runs ./go update_cddl before a separate if command without making the
update's failure terminate the enclosing Bazel step. Because Bazel executes that multiline input on
the left side of a tee pipeline, a successful final if can mask an update failure, allowing its
partial changes to be saved as a patch and published.

Code

.github/workflows/update-cddl.yml[R21-22]

+        ./go update_cddl
+        if git diff --quiet -- common/bidi/schema.json; then git reset -q --hard; fi

Evidence
The added input has two commands; Bazel places them in a command group piped to tee, where an
earlier failure need not terminate execution. Its diff-saving step stages changes even after
failures, and the new publish job checks only that the patch exists before pushing it.
.github/workflows/update-cddl.yml[19-23]
.github/workflows/bazel.yml[244-253]
.github/workflows/bazel.yml[291-303]
.github/workflows/update-pr.yml[51-69]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The CDDL updater's failure can be masked by the following cleanup command, allowing partial generated changes to reach the bot PR.

## Fix Focus Areas
- .github/workflows/update-cddl.yml[20-22]
- .github/workflows/bazel.yml[244-249]

## Recommended Fix
Make the CDDL command explicitly propagate a nonzero exit before the schema check, for example with `./go update_cddl || exit $?`. Ensure the enclosing logged Bazel execution preserves failures from each command in multiline inputs.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

…sses

selenium-ci · 2026-10-18T19:30:19Z

/agentic_review

qodo-code-review · 2026-10-18T19:33:36Z

Code review by qodo was updated up to the latest commit 54ded1b

[build] update open bot PRs in place through a shared workflow so fix…

9315d80

…es pushed to them survive the next run

selenium-ci added the B-build Includes scripting, bazel and CI integrations label Oct 18, 2026

qodo-code-review Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread .github/workflows/update-pr.yml Outdated

Comment thread .github/workflows/update-cddl.yml

[build] check out the bot branch with an explicit if so shellcheck pa…

54ded1b

…sses

qodo-code-review Bot reviewed Oct 18, 2026

View reviewed changes

Comment thread .github/workflows/update-cddl.yml

Comment thread .github/workflows/update-pr.yml

titusfortner merged commit 434f278 into trunk Oct 18, 2026
34 checks passed

titusfortner deleted the bot-pr-updates-in-place branch October 18, 2026 19:59

Navigation Menu

Repository navigation

[build] update open bot PRs in place through a shared workflow so fixes pushed to them survive the next run - #18197

[build] update open bot PRs in place through a shared workflow so fixes pushed to them survive the next run#18197
titusfortner merged 2 commits into
trunkfrom
bot-pr-updates-in-place

titusfortner commented Oct 18, 2026

Uh oh!

selenium-ci commented Oct 18, 2026

Uh oh!

selenium-ci commented Oct 18, 2026

Uh oh!

qodo-code-review Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

qodo-code-review Bot commented Oct 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

selenium-ci commented Oct 18, 2026

Uh oh!

Uh oh!

Uh oh!

qodo-code-review Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

titusfortner commented Oct 18, 2026

🔗 Related Issues

💥 What does this PR do?

🔧 Implementation Notes

🤖 AI assistance

🔄 Types of changes

Uh oh!

selenium-ci commented Oct 18, 2026

Uh oh!

selenium-ci commented Oct 18, 2026

Uh oh!

qodo-code-review Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary by Qodo

Uh oh!

qodo-code-review Bot commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

selenium-ci commented Oct 18, 2026

Uh oh!

Uh oh!

Uh oh!

qodo-code-review Bot commented Oct 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

qodo-code-review Bot commented Oct 18, 2026 •

edited

Loading

qodo-code-review Bot commented Oct 18, 2026 •

edited

Loading