Repository navigation
web-deploy.yml blog-baseline auto-refresh permanently broken by develop branch protection #2915
Description
Problem
The post-merge blog visual-baseline auto-refresh in .github/workflows/web-deploy.yml ("Commit pre-refreshed blog baseline" step, git push origin HEAD:develop at ~line 328) is rejected by the develop branch-protection rule: GH013: Changes must be made through a pull request. All 5 retries fail, so the refreshed web/tests/visual-baselines/blog.png never lands.
Observed concretely after #2896 (commit 0ec62e4d4) published the 4.0.3 release post: develop run 27254568247 pre-refreshed the baseline but could not push it back, leaving the baseline stale on develop. Every subsequent web/**-touching PR (e.g. #2913) then fails the Visual regression check with a deterministic ~60k-pixel diff (the new post card shifting the blog index) until someone refreshes manually.
Impact
Every blog-post merge strands a stale baseline and red-Xes all later web-touching PRs — manual refresh-visual-baselines.yml runs are needed each time. Silent failure mode: the deploy run itself stays green.
Suggested approach
Convert the auto-refresh push to a PR + auto-merge flow, same pattern as refresh-packages-baseline.yml. Note the PAT used must have Pull-requests: write in addition to Contents: write, or the auto-merge step fails silently (prior art: the scoop/homebrew auto-update chain).
Acceptance criteria
- Merging a blog post to develop results in the refreshed blog baseline landing on develop without manual intervention (via auto-merged PR).
- A subsequent
web/**PR passes Visual regression without a manual baseline refresh.
Source
Found during the 2026-06-09 framework-review remediation campaign while diagnosing the #2913 Visual-regression failure.
Activity
wheels-bot commentedon Jun 10, 2026
Wheels Bot — Triage
Classified as bug.
Suspected layer
Repo CI infrastructure —
.github/workflows/web-deploy.yml(and the siblingrefresh-packages-baseline.ymlas prior-art reference). This sits outside the framework layer system documented in.ai/wheels/(model / controller / view / router / middleware / migrator / cli / di / job / mailer / sse / seed / config); the closest analog isconfig, but the fix is YAML, not CFML.Fix sketch
Replace the direct
git push origin HEAD:develop(~line 328 of.github/workflows/web-deploy.yml, "Commit pre-refreshed blog baseline" step) with the PR + auto-merge pattern already used by.github/workflows/refresh-packages-baseline.yml: create achore/refresh-blog-baseline-<sha>branch, push the refreshedweb/tests/visual-baselines/blog.pngto it,gh pr createagainstdevelop, thengh pr merge --auto --squash. Confirm the PAT used hasPull-requests: writein addition toContents: write(the issue calls this out explicitly — the scoop/homebrew chain is prior art for silent failures here). Worth double-checking whether the same direct-push pattern exists elsewhere inweb-deploy.ymlor other workflows, since branch protection ondevelopwould reject any of them.Confidence:
lowFix shape is clear and well-described, but it lives outside framework layer docs (CI YAML, not CFML) and requires repo-secret / PAT-scope decisions propose-fix can't safely make — better routed to a human who can verify the PAT has the right scopes.
<!-- wheels-bot:triage:2915 -->
<!-- wheels-bot:triage-class:bug -->