[NGOv3.X] CI fixes and adjustments

.github/workflows/pr-supervisor.yaml

@@ -2,8 +2,8 @@
 # We are using https://cli.github.com/manual/gh_pr_checks
 # The aim is to ensure that conditionally triggered Yamato jobs are completed successfully before allowing merges
 
-# This job will be required in branch protection rules for develop, develop-2.0.0, develop-3.x.x, and release/* branches. It's only goal will be to ensure that Yamato jobs are completed successfully before allowing Pr to merge.
-# Note that conditional jobs will have 30s to show which is always the cas since they are showing up as soon as in distribution stage.
+# This job will be required in branch protection rules for develop and release/* branches. It's only goal will be to ensure that Yamato jobs are completed successfully before allowing Pr to merge.
+# Note that conditional jobs will have 30s to show which is always the case since they are showing up as soon as in distribution stage.
 
 name: Yamato PR Supervisor
 
@@ -24,43 +24,58 @@ jobs:
   yamato-supervisor:
     runs-on: ubuntu-latest
     timeout-minutes: 720
+    permissions:
+      actions: read
+      checks: read
+      statuses: read
+      pull-requests: read
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
+
+
       - name: Wait and Verify Yamato Job Status
         env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           set -e
-
-
+          
+          
           MAX_ATTEMPTS=$((12*60))
           INTERVAL=60
-
+          
           sleep $INTERVAL
           for ((i=1;i<=MAX_ATTEMPTS;i++)); do
             echo "Polling PR checks (attempt $i/$MAX_ATTEMPTS)..."
+
+            # gh pr checks exits non-zero while checks are pending (8) or failing (1); we evaluate state ourselves, so don't let that abort the loop.
+            checks=$(gh pr checks $PR_NUMBER --json name,state --jq '[ .[] | select(.name != "yamato-supervisor") ]') || true
 
-            # We want to watch for pending checks beside this check
-            checks=$(gh pr checks $PR_NUMBER --json name,state --jq '[ .[] | select(.name != "yamato-supervisor") ]')
+            if [[ -z "$checks" ]]; then
+              echo "No non-supervisor checks reported yet; waiting..."
+              sleep $INTERVAL
+              continue
+            fi
 
             pending=$(echo "$checks" | jq '[.[] | select(.state == "PENDING")] | length')
             skipping=$(echo "$checks" | jq '[.[] | select(.state == "SKIPPED")] | length')
             passed=$(echo "$checks" | jq '[.[] | select(.state == "SUCCESS")] | length')
             failed=$(echo "$checks" | jq '[.[] | select(.state == "FAILURE")] | length')
-
-            echo "Pending checks: $pending, Skipping checks: $skipping", Passed checks: $passed, Failed checks: $failed
-
+          
+            echo "Pending checks: $pending; Skipping checks: $skipping, Passed checks: $passed, Failed checks: $failed"
+          
             if [[ "$failed" -gt 0 ]]; then
               echo "A check has failed! Failing fast."
+              echo "If you rerun the job and everything is green then just rerun this job as well."
               exit 1
             fi
 
             if [[ "$pending" -eq 0 ]] && [[ "$passed" -gt 0 ]]; then
               echo "All non-supervisor checks are completed!"
               exit 0
             fi
-
+          
             sleep $INTERVAL
-          done
+          done