[leifj]

Org-level tooling for integration branches ("bags of PRs" used to test several unmerged PRs together), replacing the proposal in sirosfoundation/sirosid-dev#90 and sirosfoundation/sirosid-dev#91 (which depended on sirosid-dev; they would be closed). This repo says changes here need discussion before merging: please do not merge until agreed; nothing runs until a repository adopts the template.

What

• actions/integration/ (composite action + integration.py, Python stdlib + PyYAML): an integration/<name> branch is generated from a plan committed in the branch (.integration/plan.yaml: base, ordered merge / rebase / glue steps, ephemeral, and the locked heads written by sync). verify replays the locked plan and requires an identical tree (ignoring .integration/), so a hand edit, a patch commit, a conflict resolved by hand or a change hidden in a merge cannot be on the branch. report and comment read the plan.
• Glue branches are the only place a conflict may be resolved, and verify classifies them: resolution-only (every added line already exists in the tip before it, the base or a plan PR head: no review needed) or new code (lines found nowhere else: needs a draft PR and review).
• .github/workflows/integration-build.yml (reusable): verify, then build through docker-build-push.yml (Buildx, cache, Trivy), tag <branch>-<sha7>; the digest is in the run output. PR cross-reference comments are parked for a follow-up (the comment command, job and secret were removed from this PR so the core can be validated first).
• workflow-templates/integration.yml: on: push: branches: ['integration/**'].
• docker-build-push.yml: new optional target input and a digest output (backward compatible, both default to the old behaviour).
• docs/integration-branches.md + README link; .github/workflows/integration-tests.yml runs the tests and actionlint.

Tests

actions/integration/tests/test_integration.py (14, real git repositories; the "remotes" are local repos with refs/pull/N/head): sync + verify; a patch commit and a change hidden in a merge fail; verify replays the locked heads when a PR has moved; a pinned moved head is refused; a conflict stops the sync and demands a glue step; glue classification (resolution-only vs new code); rebase steps (applies / refused when it does not apply); report from the plan with no API; legacy verify. Mutation checks: disabling the tree comparison fails the patch and hidden-change tests; disabling the novelty check fails the new-code test. actionlint is clean.

Validated on real data (2026-10-22)

The engine branch deployed on gdc (46c2e4f, sirosfoundation/go-wallet-backend#469, sirosfoundation/go-wallet-backend#471, sirosfoundation/go-wallet-backend#163, sirosfoundation/go-wallet-backend#472 plus local commits and hand resolutions): a plan of two clean PR merges plus one glue step reproduces its tree exactly (the regenerated tree equals 46c2e4f's). Pairwise, #163 conflicts with #469 and #471, and #472 conflicts with #469 and #471 (#469+#471 and #163+#472 merge cleanly), which is why the deployed branch needed hand resolutions. The glue classification finds 279 lines in 7 files that exist in no PR - 216 in tests, 52 in wmphandler.go (the WMP sign-params glue), 6 in oid4vp.go and 5 in oid4vci_blind_response.go (the sign-refusal fix) - i.e. the two local-only commits; the hand-resolved conflicts in session.go contribute no new lines (resolution-only), as the go-wallet-backend session said.

Not covered / decisions needed

• Never run in CI: the workflows can only be exercised after merge and adoption by a repo.
• Fetching other repos' PR heads is over https: public repos only. A rebase step needs its locked head to stay fetchable.
• integration-build.yml calls actions/integration@main and docker-build-push.yml@main (like the other org workflows); pinning is a follow-up.

🤖 Generated with Claude Code