From 105543690e5688fba9028c12128e88774194a067 Mon Sep 17 00:00:00 2001
From: alexbelgium <alexandre.pary@gmail.com>
Date: Thu, 23 Jul 2026 15:31:20 +0200
Subject: [PATCH] fix: go live on tier 1, self-provision ai:blocked
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- on_issues_ai_triage.yaml: remove DRY_RUN entirely. AI_PR_TOKEN is now
  configured, tier 1 has been watched in dry-run, and the toggle was
  meant to be temporary scaffolding, not a permanent code path — verdicts
  now apply labels/comments unconditionally.
- daily_ai_fix.yaml: fold ai:blocked into the existing "ensure labels
  exist up front" step (renamed to reflect that). It was the one control
  label neither workflow ever created: the forbidden-paths guard applies
  it directly, and under set -euo pipefail a missing label there aborts
  that step's loop entirely, silently skipping every remaining PR behind
  the one that failed. No repo had hit this yet only because no label in
  the ai:*/ai-* namespace existed at all before now.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/daily_ai_fix.yaml        | 10 +++++++---
 .github/workflows/on_issues_ai_triage.yaml |  9 ---------
 2 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/daily_ai_fix.yaml b/.github/workflows/daily_ai_fix.yaml
index 8c807a4834..d16497c642 100644
--- a/.github/workflows/daily_ai_fix.yaml
+++ b/.github/workflows/daily_ai_fix.yaml
@@ -87,15 +87,19 @@ jobs:
 
       # Created up front so issue-fix.md's per-issue relabel never has to
       # improvise a color or retry a "label does not exist" error — that's a
-      # wasted turn multiplied by every issue in the batch.
-      - name: Ensure relabel targets exist
+      # wasted turn multiplied by every issue in the batch. Also covers
+      # ai:blocked, which the forbidden-paths guard applies later in this
+      # same job: with set -euo pipefail, `gh pr edit --add-label` on a
+      # label that doesn't exist yet fails and aborts that step's loop
+      # entirely, silently skipping every remaining PR behind it.
+      - name: Ensure control labels exist
         if: steps.batch.outputs.count != '0'
         env:
           GH_TOKEN: ${{ secrets.AI_PR_TOKEN }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
-          for l in ai:fixed ai:upstream ai:needs-human; do
+          for l in ai:fixed ai:upstream ai:needs-human ai:blocked; do
             gh label create "$l" --repo "$REPO" --color ededed --force >/dev/null 2>&1 || true
           done
 
diff --git a/.github/workflows/on_issues_ai_triage.yaml b/.github/workflows/on_issues_ai_triage.yaml
index e1875f0804..74bb18a5e3 100644
--- a/.github/workflows/on_issues_ai_triage.yaml
+++ b/.github/workflows/on_issues_ai_triage.yaml
@@ -24,9 +24,6 @@ concurrency:
 
 env:
   MAINTAINER: alexbelgium
-  # Leave "true" for the first couple of weeks. The verdict is printed in the
-  # job log and nothing is written to the issue. Flip when it looks right.
-  DRY_RUN: "true"
 
 jobs:
   classify:
@@ -120,12 +117,6 @@ jobs:
           [ "$VERDICT" = "addon-bug" ] && LABELS+=("ai-triage")
           LABELS+=("ai:classified")
 
-          if [ "${DRY_RUN:-true}" = "true" ]; then
-            echo "DRY_RUN: would apply labels: ${LABELS[*]}"
-            echo "DRY_RUN: would post comment:"; printf '%s\n' "$COMMENT"
-            exit 0
-          fi
-
           for l in "${LABELS[@]}"; do
             gh label create "$l" --repo "$REPO" --color ededed --force >/dev/null 2>&1 || true
           done