no fix when auto rebase workflow fails

[don-petry]

When the auto rebase workflow fails, no automation fixes it. Review and enhance either the rebase workflow or dev-lead to fix.

[don-petry]

Example: #624

[don-petry]

Dev-Lead Implementation Plan

Issue: #645 — no fix when auto rebase workflow fails

Scope

Add self-healing automation that retries the Auto-rebase workflow when its run fails (conclusion=failure) — the gap not covered by the existing merge-conflict sentinel path, which only handles clean conflicts via the dev-lead rebase intent.

Background

• Merge conflicts during rebase are already handled: the auto-rebase reusable posts a <!-- auto-rebase-conflict: sentinel comment, which dev-lead's intent classifier routes to the rebase intent.
• But when the auto-rebase workflow run itself fails (script/API/transient error, conclusion=failure), no sentinel is posted and nothing retries it — the gap this issue describes.
• auto-rebase.yml is a thin caller stub and the reusable lives in the central repo, so the fix is a new repo-local workflow_run failure handler that re-runs failed jobs, bounded by attempt count.

Implementation Checklist

• scripts/auto-rebase-retry.sh — guard on conclusion=failure, bounded retry via gh run rerun <id> --failed up to MAX_ATTEMPTS, surface a warning + step summary when retries are exhausted
• .github/workflows/auto-rebase-retry.yml — workflow_run (completed) trigger scoped to "Auto-rebase non-Dependabot PRs", actions: write to rerun
• AGENTS.md — document this as a repo-specific workflow exception (no central template), mirroring the token-report exception
• .github/workflows/test-dev-lead.yml — add the new workflow/script to path triggers

Tests to Write

• tests/dev-lead/unit/test_auto_rebase_retry.bats:
  • non-failure conclusion (success/cancelled) → noop, no rerun
  • failure + attempt < max → reruns failed jobs
  • failure + attempt >= max → no rerun, emits give-up warning
  • missing/invalid RUN_ID → safe noop
  • DRY_RUN → logs intent, no rerun call

Test Command

bats tests/dev-lead/unit/test_auto_rebase_retry.bats (full suite: bats tests/dev-lead/unit/)

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• scripts/auto-rebase-retry.sh — workflow_run failure handler: guards on conclusion=failure, bounded retry via gh run rerun <id> --failed up to MAX_ATTEMPTS, surfaces a ::warning:: + step summary when retries are exhausted
• .github/workflows/auto-rebase-retry.yml — workflow_run (completed) handler scoped to "Auto-rebase non-Dependabot PRs", job-level actions: write, run-id concurrency group
• AGENTS.md — documented as a repo-specific workflow exception (no central template), mirroring the token-report exception
• .github/workflows/test-dev-lead.yml — added the new workflow + script to path triggers
• tests/dev-lead/unit/test_auto_rebase_retry.bats — 10 cases (auto-discovered by the existing bats tests/dev-lead/unit/ job)

Gap Addressed

Merge conflicts during rebase were already handled (auto-rebase posts a <!-- auto-rebase-conflict: sentinel → dev-lead rebase intent). The uncovered case was a failed run (transient API error, rate-limit, infra hiccup): no sentinel is posted and nothing retried it. Since auto-rebase.yml is a thin caller and the reusable lives in the central repo, the fix is a repo-local workflow_run failure handler that self-heals by re-running failed jobs, bounded by run_attempt.

Test Results

$ bats tests/dev-lead/unit/
1..441
... (all pass; new suite below)

$ bats tests/dev-lead/unit/test_auto_rebase_retry.bats
1..10
ok 1 auto-rebase-retry: failure on first attempt → reruns failed jobs
ok 2 auto-rebase-retry: success conclusion → noop, no rerun
ok 3 auto-rebase-retry: cancelled conclusion → noop, no rerun
ok 4 auto-rebase-retry: attempt at cap → no rerun, gives up with warning
ok 5 auto-rebase-retry: attempt past cap → no rerun
ok 6 auto-rebase-retry: last allowed attempt (cap-1) → reruns
ok 7 auto-rebase-retry: missing RUN_ID → noop, no rerun
ok 8 auto-rebase-retry: non-numeric RUN_ATTEMPT defaults to 1 → reruns
ok 9 auto-rebase-retry: DRY_RUN → logs intent, does not rerun
ok 10 auto-rebase-retry: rerun API failure → warns but exits 0

Lint: dev-lead-lint.sh (shellcheck + agent frontmatter) PASS · shellcheck --severity=warning PASS · yamllint PASS · actionlint PASS · test_auto_rebase_stub.py PASS.

Files Changed

• scripts/auto-rebase-retry.sh (new): bounded self-heal handler for failed Auto-rebase runs
• .github/workflows/auto-rebase-retry.yml (new): workflow_run trigger wiring
• tests/dev-lead/unit/test_auto_rebase_retry.bats (new): unit coverage
• AGENTS.md: documented repo-specific exception
• .github/workflows/test-dev-lead.yml: path triggers for the new files

Notes

• Multi-retry chaining (past the first attempt) relies on GH_PAT_WORKFLOWS: re-runs requested via the default GITHUB_TOKEN do not re-fire workflow_run events (GitHub's recursion guard). With github.token alone, a single retry still fires; the run_attempt/MAX_ATTEMPTS cap bounds the loop in all cases. This matches the existing GH_PAT_WORKFLOWS || github.token pattern used by dev-lead-retry and ci-relay.
• The handler always exits 0 — outcomes surface via annotations + step summary rather than failing the handler itself (which would just add noise).