PR Gate Check
DevOps & Securitypr-gate-checkPR Gate Check is an Agent Skill for devops & security published in the oracle/graalpython repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Check gate status for a Bitbucket PR by resolving the PR head commit, finding the gate merge commit, inspecting builds on that merge commit, and summarizing root-cause failures with actionable next steps.
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/oracle/graalpython/blob/HEAD/.agents/skills/pr-gate-check/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/pr-gate-check, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
PR Gate Check
Overview
Use this workflow when asked for gate status of a PR. Usually the builds are tied to a merge commit generated on Bitbucket, so this skill goes through finding the remote merge commit.
Workflow
- Get PR commits and identify PR head commit (first commit in
gdev-cli bitbucket commitsoutput):
gdev-cli bitbucket commits --project=G --repo=graalpython --pullrequest=<PR_ID> --all --json
- Fetch refs and locate merge commit whose parent includes PR head:
git ls-remote origin 'refs/pull-requests/<PR_ID>/*'
git fetch --no-tags origin '+refs/heads/*:refs/remotes/origin/*' --prune
git rev-list --all --parents | rg ' <PR_HEAD_SHA>( |$)'
Pick the merge commit where one parent is <PR_HEAD_SHA> and the other is the target branch tip at merge time.
If you cannot find it this way, another heuristic is to take the branch name and append _gate - that usually has the merge commit we want as tip.
- Check builds on that merge commit:
gdev-cli bitbucket get-builds --commit=<MERGE_SHA> --all --format=key,state,url
- Separate root failures from fan-out failures:
FAILED+/builders/.../builds/...URL: executed failed build (root failure candidate).FAILED+build_request?brid=URL: usually not-run/downstream due to earlier failure.
- Inspect root failed build logs and extract exact failing test/error:
- Open build URL and
Run executorstdio log. - Capture failing test id, traceback/assertion, and command context.
- Report back:
- PR head SHA
- merge SHA + parents (target parent + PR parent)
- build summary counts
- root cause failure(s)
- fix options and next action question
Output Template
PR head:<sha>Gate merge commit:<sha>(parent1=<target_sha>,parent2=<pr_sha>)Builds:<total>total,<success>successful,<failed>failedRoot failure(s):
<build key>:<error summary><failing test/path><build url>
Proposed fixes:short list- Ask user what to do next.
Guardrails
- Do not conclude from PR commit statuses alone; always resolve and inspect merge-commit builds.
- If many builds are failed but only one executed failure exists, treat that one as primary cause.
- Keep proposed fixes minimal and scoped to observed failure.