claw: claw-t27f/suggest/refresh pass with a note when the App token cannot be minted; claw-refresh can read the queue (#10576)

.github/workflows/gate-topology.yml

@@ -88,10 +88,11 @@ jobs:
       - id: have
         env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID }}"}
         run: if [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/t27f posted nothing - secret CLAW_APP_PRIVATE_KEY or variable CLAW_APP_ID is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
-      - {id: tok, if: steps.have.outputs.ok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, permission-checks: write, permission-pull-requests: read, permission-contents: read}}
-      - {if: steps.have.outputs.ok, uses: actions/checkout@v6}
-      - {if: steps.have.outputs.ok, uses: sigstore/cosign-installer@v3}
-      - if: steps.have.outputs.ok
+      - {id: tok, if: steps.have.outputs.ok, continue-on-error: true, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, permission-checks: write, permission-pull-requests: read, permission-contents: read}}
+      - {if: steps.tok.outcome == 'failure', run: echo "claw/t27f posted nothing - the TRI CLAW App could not mint a token with checks write; grant it and accept it on the installation - docs/claw/README.md steps 1-2." >> "$GITHUB_STEP_SUMMARY"}
+      - {if: steps.tok.outputs.token, uses: actions/checkout@v6}
+      - {if: steps.tok.outputs.token, uses: sigstore/cosign-installer@v3}
+      - if: steps.tok.outputs.token
         env: {GH_TOKEN: "${{ steps.tok.outputs.token }}", V: t27o-v0.1.0}
         shell: bash {0}
         run: |
@@ -153,9 +154,10 @@ jobs:
       - id: have
         env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}"}
         run: if [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/suggest posted nothing - secret CLAW_APP_PRIVATE_KEY or CLAW_APP_ID (variable or secret) is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
-      - {id: tok, if: steps.have.outputs.ok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-pull-requests: write, permission-contents: read}}
-      - {if: steps.have.outputs.ok, uses: actions/checkout@v6, with: {ref: "${{ github.event.pull_request.head.sha }}", persist-credentials: false}}
-      - if: steps.have.outputs.ok
+      - {id: tok, if: steps.have.outputs.ok, continue-on-error: true, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-pull-requests: write, permission-contents: read}}
+      - {if: steps.tok.outcome == 'failure', run: echo "claw/suggest posted nothing - the TRI CLAW App could not mint a token with pull_requests write; grant it and accept it on the installation - docs/claw/README.md steps 1-2." >> "$GITHUB_STEP_SUMMARY"}
+      - {if: steps.tok.outputs.token, uses: actions/checkout@v6, with: {ref: "${{ github.event.pull_request.head.sha }}", persist-credentials: false}}
+      - if: steps.tok.outputs.token
         env: {GH_TOKEN: "${{ steps.tok.outputs.token }}", R: "${{ github.repository }}", N: "${{ github.event.pull_request.number }}", S: "${{ github.event.pull_request.head.sha }}"}
         run: |
           printf '#include "gen/c/claw/suggest_feed.c"\n#include <stdio.h>\n#include <stdlib.h>\nint main(void){size_t k=1<<24,n;uint8_t*b=malloc(k),*o=malloc(k);uint32_t s[9];n=fread(b,1,k,stdin);if(n==k)return 3;size_t m=suggest_review(b,n,o,k,s);fprintf(stderr,"claw/suggest: posted %%u, outside the diff %%u, over the caps %%u, too big %%u, unreadable %%u, files %%u, refused %%u, bad input %%u, truncated %%u\\n",s[0],s[1],s[2],s[3],s[4],s[5],s[6],s[7],s[8]);if(m>k)return 4;fwrite(o,1,m,stdout);return 0;}\n' | cc -O1 -w -I . -x c -o /tmp/feed -
@@ -170,23 +172,24 @@ jobs:
           if [ -s /tmp/review.json ]; then gh api -X POST "repos/$R/pulls/$N/reviews" --input /tmp/review.json -q .html_url >> "$GITHUB_STEP_SUMMARY"; fi
 
   # #10397: after a push to master, bring every conflict-free open PR that fell behind up to date.
-  # The decision (which PRs, which order, the cap of 30, every skip) is specs/claw/refresh.t27 lowered
+  # The decision (which PRs, which order, the cap of 5, the queue limit of 150, every skip) is specs/claw/refresh.t27 lowered
   # to gen/c/claw/refresh.c; this job lists, feeds the C, and calls the endpoint for each `R` line.
   # The token is the update-branch row of specs/claw/github_surface.t27: pull_requests write and
   # nothing else. If GitHub answers 403 here, the App also needs contents:write for update-branch
   # (REST docs); the failure is a warning with GitHub's own text, never a red job.
   claw-refresh:
     if: github.event_name == 'push'
     runs-on: ubuntu-24.04
-    permissions: {contents: read, pull-requests: read}
+    permissions: {contents: read, pull-requests: read, actions: read}
     concurrency: {group: claw-refresh, cancel-in-progress: true}
     steps:
       - id: have
         env: {K: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", I: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}"}
         run: if [ -n "$K" ] && [ -n "$I" ]; then echo ok=1 >> "$GITHUB_OUTPUT"; else echo "claw/refresh updated nothing - secret CLAW_APP_PRIVATE_KEY or CLAW_APP_ID (variable or secret) is not set (docs/claw/README.md)." >> "$GITHUB_STEP_SUMMARY"; fi
-      - {id: tok, if: steps.have.outputs.ok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-pull-requests: write}}
-      - {if: steps.have.outputs.ok, uses: actions/checkout@v6, with: {persist-credentials: false}}
-      - if: steps.have.outputs.ok
+      - {id: tok, if: steps.have.outputs.ok, continue-on-error: true, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-pull-requests: write}}
+      - {if: steps.tok.outcome == 'failure', run: echo "claw/refresh updated nothing - the TRI CLAW App could not mint a token with pull_requests write; grant it and accept it on the installation - docs/claw/README.md steps 1-2." >> "$GITHUB_STEP_SUMMARY"}
+      - {if: steps.tok.outputs.token, uses: actions/checkout@v6, with: {persist-credentials: false}}
+      - if: steps.tok.outputs.token
         env: {GH_TOKEN: "${{ github.token }}", CLAW_TOKEN: "${{ steps.tok.outputs.token }}", R: "${{ github.repository }}"}
         run: |
           printf '#include "gen/c/claw/refresh.c"\n#include <stdio.h>\n#include <stdlib.h>\nint main(int c,char**v){size_t k=1<<22,n;uint8_t*b=malloc(k),*o=malloc(k);n=fread(b,1,k,stdin);if(n==k)return 3;size_t m=refresh_plan(b,n,o,k,atoi(v[1]));if(m>k)return 4;fwrite(o,1,m,stdout);return 0;}\n' | cc -O1 -w -I . -x c -o /tmp/feed -
@@ -222,7 +225,7 @@ jobs:
     runs-on: ubuntu-24.04
     permissions: {contents: read}
     steps:
-      - {id: tok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-contents: write, permission-pull-requests: write}}
+      - {id: tok, uses: actions/create-github-app-token@v2, with: {app-id: "${{ vars.CLAW_APP_ID || secrets.CLAW_APP_ID }}", private-key: "${{ secrets.CLAW_APP_PRIVATE_KEY }}", owner: gHashTag, repositories: t27, permission-contents: write, permission-pull-requests: write}}  # token_shape: red - an operator asked for this batch; a token that cannot be minted must fail the run, not hide in a note
       - {uses: actions/checkout@v6, with: {ref: master, fetch-depth: 0, token: "${{ steps.tok.outputs.token }}"}}
       - env: {GH_TOKEN: "${{ steps.tok.outputs.token }}", PRS: "${{ inputs.prs }}", SLUG: "${{ steps.tok.outputs.app-slug }}", RUN: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}", B: "claw/batch-${{ github.run_id }}"}
         shell: bash {0}