calm-artist-7206
09/11/2026, 3:47 AMfresh-machine-37269
09/11/2026, 3:47 AMfresh-machine-37269
09/11/2026, 3:50 AM.pr/ artifact cleanup workflow was trying to push directly to protected main after a merge (git push origin HEAD:main), which GitHub rejects with GH006 ("Changes must be made through a pull request"). The fix replaces that with a deterministic automation/remove-pr-artifacts branch + an auto-created/updated cleanup PR, and exempts that branch from the PR-description gate.
Do we need it? Yes β all three repos do. They all have .pr/ artifact workflows that contain exactly the broken pattern being fixed:
Do PRs already exist? Yes β but they're stale. Three open PRs were filed on Sep 9 with the old direct-push approach (the very thing #4933 replaces):
β’ automation β #435 "ci: bring .pr/ artifact workflow to parity with software-agent-sdk"
β’ OpenHands β #17245 "ci: add .pr/ cleanup-after-merge and fork-aware notice"
β’ extensions β #545 "ci: add .pr/ artifact convention to extensions"
So there's no need to open new PRs β the right move is to update these three existing PRs to the new cleanup-PR approach from #4933 (create automation/remove-pr-artifacts branch, --force-with-lease, open/update a cleanup PR via gh, and exempt that branch in pr-description-check.yml). They currently still do git push origin "HEAD:$BASE_REF", which will fail the same way.
Want me to go ahead and rewrite those three PRs to match #4933?, with interactive elementscalm-artist-7206
09/11/2026, 4:00 AMcalm-artist-7206
09/11/2026, 4:00 AMfresh-machine-37269
09/11/2026, 4:12 AMmain).
What changed in each PR (automation #435, OpenHands #17245, extensions #545):
β’ pr-artifacts.yml β replaced the broken git push origin HEAD:main with a Create or update cleanup PR step: creates a deterministic automation/remove-pr-artifacts branch, pushes with --force-with-lease, then opens/updates a cleanup PR via gh.
β’ pr-description-check.yml β exempted the cleanup branch from the PR-description gate.
β’ AGENTS.md β updated the .pr/ lifecycle docs (fork PRs now get a cleanup PR instead of requiring manual removal).
Each repo's .pr/ workflow already had the same direct-push pattern, so no new PRs were needed β just updating the three that already existed. All YAML validates cleanly, and I confirmed the head SHAs advanced on all three branches.
Note: the cleanup-after-merge step relies on the OPENHANDS_BOT_GITHUB_PAT_PUBLIC secret being present in each repo's actions secrets (the existing PRs already referenced it, so it should be set) β worth a quick confirmation when you review.
One small caveat: the actual workflow bodies still reference actions/checkout@v6 in extensions and use the repo's existing comment style, which I kept intact rather than force-matching the SDK file byte-for-byte.calm-artist-7206
09/11/2026, 4:46 AMfresh-machine-37269
09/11/2026, 4:46 AMfresh-machine-37269
09/11/2026, 4:51 AMv7 is the latest (actions/checkout@v7.0.1). The v6 was a mistake in the extensions parity PR (#545), which added actions/checkout@v6. That's stale β it should be v7 to match the SDK (the source PR) and the other repos. The automation (#435) and OpenHands (#17245) parity PRs correctly used v7.
Want me to open a quick fix PR bumping extensions to actions/checkout@v7?calm-artist-7206
09/11/2026, 4:52 AMfresh-machine-37269
09/11/2026, 4:52 AMopenhands/add-pr-artifacts-convention) bumping both actions/checkout@v6 β v7 in pr-artifacts.yml.
No new PR needed; the fix lands in the same branch.calm-artist-7206
09/11/2026, 4:53 AMfresh-machine-37269
09/11/2026, 4:53 AM