[devantler]

Why

A template sync that did everything right could still be reported as failed. After the helper moved the generated branch to the App-signed commit, it read the branch back once and compared. GitHub sometimes still returns the previous commit for a moment after an update, so that one read failed the run although the branch was correct. It happened on 11 November in ascoachingogvaner: the sync opened its pull request with a verified commit, and the run went red on the default branch.

What

The helper now reads the branch back up to five times, two seconds apart, and stops as soon as it sees the signed commit. If the branch still points elsewhere after the last read, it fails with the same message as before. Nothing else in the signing path changes: the commit readback, the verification verdict and the order of the steps are as they were.

Two test cases cover it. One serves the old commit once and then the signed one, and expects success after exactly two reads. The other never serves the signed commit, and expects the same failure after exactly five reads. Against the script on main the first case fails; with the final check removed the second fails.

Fixes #897

🤖 Generated with Claude Code

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

User trial at 2a6d6d8c9f2e293787e09b056281603b9f415b69

• The real failure this fixes. Run 42977853659, attempt 1 in ascoachingogvaner: the sync opened its pull request with a verified App commit, and the signing step then failed on the single branch read. The branch did point at the signed commit afterwards.
• Replayed with the helper's own stand-in for GitHub. With one stale read after the update, the helper on main fails with "generated branch does not point to the verified replacement"; on this branch it succeeds and reads the branch exactly twice.
• It still fails closed. When the branch never shows the signed commit, the helper fails with the same message after exactly five reads. With the final check removed, that test case fails, so the test would catch a version that waves a wrong branch through.
• Nothing else moved. The other three template-sync suites that use this helper (pin order, ignore-entry merge, empty-sync discard) pass unchanged.

Not proven here: a live sync that hits a stale read again. That depends on GitHub's timing and cannot be forced; the next red run of this kind would show it, and none is expected.

🤖 Generated with Claude Code

[github-code-quality]

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main de6045d	claude/template-sync... 2a6d6d8	+/-
50%	50%	0%

C# / code-coverage/dotnet

main de6045d	claude/template-sync... 2a6d6d8	+/-
100%	100%	0%

Go / code-coverage/go

main de6045d	claude/template-sync... 2a6d6d8	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 11, 2026 08:06 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 14 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/.github
• Branch: claude/template-sync-readback-897
• File: .coderabbit.yaml
• Commit: 2a6d6d8
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f30f0246-751c-4f55-9a1d-2203b7b73eb0

Commits

Reviewing files that changed from the base of the PR and between de6045d and 2a6d6d8.

Files selected for processing: 2

• .github/scripts/replace-template-sync-commit.sh
• .github/tests/test-template-sync-signed-commit.sh

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-11T08:14:27.336442Z	2a6d6d8	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 2a6d6d8c9f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".