/
/
/
# What does this implement/fix? The `music-assistant-models` and `music-assistant-frontend` pins sit on adjacent lines in `pyproject.toml`, and because `requirements_all.txt` is sorted they are alphabetical neighbours there too. Each bump branch is cut from `dev` when its own package releases. When both PRs are open, the one that merges second lands inside the other's diff context and conflicts. A conflicting PR cannot auto-merge, so somebody resolves it by hand. That breaks the flow twice over: - The merge commit is authored by a human, and the `Verify commit authors` gate requires every commit to be the App bot. Auto-merge then fails permanently on that PR. - Resolving in the GitHub web editor bypasses pre-commit, so `requirements_all.txt` keeps the hand-merged order and the `gen_requirements_all` hook fails lint. Five of the last thirteen models bumps hit this (#5495, #5419, #5388, #5117, #5095) and each one was merged by hand. This makes the recovery automatic instead of manual, so the process stays hands off. It does not relax the author gate. With the refresh in place no human touches these branches, so every commit stays bot-authored. ## Changes - Add a `push` trigger on `dev`, filtered to `pyproject.toml` and `requirements_all.txt`, which is exactly the condition that can strand a bump PR. - Add `discover-stale`: lists open `auto-update-(models|frontend)-*` PRs, skips those still on top of `dev`, and skips any whose diff contains anything other than a version pin, so a PR carrying real work is never rebuilt. - Add `refresh-stale`: checks out `dev` (never the PR head), re-applies the pin with the same `sed` the release workflows use, re-validates the diff, then re-cuts the branch through `peter-evans/create-pull-request` with the App token. The commit is authored by the bot. - Gate the existing `auto-merge` job on `github.event_name == 'pull_request_target'` so it is unaffected by the new trigger. The force-push raises a `synchronize` event, which re-runs the existing `auto-merge` job against a clean branch. That merge pushes `dev`, which re-cuts the next stale PR. The cycle drains and terminates because each pass merges one PR. **Related issue (if applicable):** - related issue <link to issue> ## Types of changes <!-- Tick exactly one box. CI (.github/workflows/pr-labels.yaml) derives the label from the ticked box and applies it automatically; the release-notes generator uses that same label to slot this change into the next release notes. --> - [ ] Bugfix (non-breaking change which fixes an issue) — `bugfix` - [ ] New feature (non-breaking change which adds functionality) — `new-feature` - [ ] Enhancement to an existing feature — `enhancement` - [ ] New music/player/metadata/plugin provider — `new-provider` - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) — `breaking-change` - [ ] Refactor (no behaviour change) — `refactor` - [ ] Documentation only — `documentation` - [ ] Maintenance / chore — `maintenance` - [x] CI / workflow change — `ci` - [ ] Dependencies bump — `dependencies` ## Checklist - [x] The code change is tested and works locally. - [x] `pre-commit run --all-files` passes. - [x] `pytest` passes, and tests have been added/updated under `tests/` where applicable. - [ ] For changes to shared models, the companion PR in `music-assistant/models` is linked. - [ ] For changes affecting the UI, the companion PR in `music-assistant/frontend` is linked. - [x] I have read and complied with the project's [AI Policy](https://github.com/music-assistant/.github/blob/main/AI_POLICY.md) for any AI-assisted contributions. - [ ] I have [raised a PR against the documentation repository](https://github.com/music-assistant/music-assistant.io/blob/main/CONTRIBUTING.md) targeting the main or beta branch as appropriate. ## Verification notes Checked locally, since a workflow cannot be exercised before it is on `dev`: - The `discover-stale` shell was dry-run against the live repo and selects correctly. - Replayed the #5495 failure at the moment it broke (branch `84f103b9` against `dev` `106e6f74`): `behind_by: 1`, diff is pin-only, so it would have been selected and rebuilt. - The `sed` applied to `dev` produces output byte-identical to a correct bump, `requirements_all.txt` ordering included. Two things only a live run can confirm: that `MUSIC_ASSISTANT_BOT_CLIENT_ID` / `MUSIC_ASSISTANT_BOT_PRIVATE_KEY` are present on this repo (inferred from `dependabot-sync-manifests.yml` using them), and that installation `146062122` has `contents: write` on a branch with an open PR.