From 6015b3e5c3db0be54b4f5a6b134bed83d83c5b06 Mon Sep 17 00:00:00 2001
From: peptiderepo <273788462+peptiderepo@users.noreply.github.com>
Date: Tue, 9 Jun 2026 13:39:18 +0700
Subject: [PATCH] ci(audit): retry PR-association check (#16)

* ci(audit): retry PR-association check to stop false positives on squash-merges

listPullRequestsAssociatedWithCommit is eventually-consistent after a squash
merge; the single immediate call intermittently flagged legit merges as
'direct push to main'. Now polls up to 5x/10s before opening an issue.

Agent-Session: cto audit-race-fix

* chore: bump plugin header to 0.5.0 to match PR_CORE_VERSION constant
---
 .github/workflows/main-push-audit.yml | 22 ++++++++++++++++------
 peptide-repo-core.php                 |  2 +-
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/main-push-audit.yml b/.github/workflows/main-push-audit.yml
index 08618e5..b4de80d 100644
--- a/.github/workflows/main-push-audit.yml
+++ b/.github/workflows/main-push-audit.yml
@@ -29,12 +29,22 @@ jobs:
         with:
           script: |
             const sha = context.sha;
-            const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              commit_sha: sha,
-            });
-            const merged = prs.find(p => p.merged_at);
+            // Squash-merge -> PR association is eventually-consistent; poll briefly
+            // before concluding this was a direct push (avoids false positives on merges).
+            async function findMergedPR() {
+              for (let attempt = 1; attempt <= 5; attempt++) {
+                const { data: prs } = await github.rest.repos.listPullRequestsAssociatedWithCommit({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  commit_sha: sha,
+                });
+                const m = prs.find(p => p.merged_at);
+                if (m) return m;
+                if (attempt < 5) await new Promise(r => setTimeout(r, 10000));
+              }
+              return null;
+            }
+            const merged = await findMergedPR();
             if (merged) {
               core.info(`OK: commit ${sha.substring(0,7)} came from PR #${merged.number}`);
               return;
diff --git a/peptide-repo-core.php b/peptide-repo-core.php
index 8cd3ab5..8b77a7a 100644
--- a/peptide-repo-core.php
+++ b/peptide-repo-core.php
@@ -3,7 +3,7 @@
  * Plugin Name: Peptide Repo Core
  * Plugin URI:  https://peptiderepo.com
  * Description: Canonical peptide schema — shared data layer for the peptiderepo.com ecosystem. Provides the peptide CPT, dosing rows, legal status cells, AI candidate queue, disclaimer component, and JSON-LD output.
- * Version:     0.4.0
+ * Version:     0.5.0
  * Author:      peptiderepo
  * Author URI:  https://peptiderepo.com
  * License:     GPL-2.0-or-later