fix: Fix GitHub pull request mergeability for multiple required workflow runs

server/events/vcs/github_client.go

@@ -481,6 +481,7 @@ type WorkflowRun struct {
 		RepositoryFileUrl githubv4.String
 		RepositoryName    githubv4.String
 	}
+	RunNumber githubv4.Int
 }
 
 type CheckRun struct {
@@ -709,6 +710,24 @@ pagination:
 	return reviewDecision, requiredChecks, requiredWorkflows, checkRuns, statusContexts, nil
 }
 
+// GetLatestCheckRun returns the checkRun with the highest runNumber, i.e., the latest checkRun whose status we need to evaluate.
+func GetLatestCheckRun(checkRuns []CheckRun) (CheckRun, error) {
+	latestCheckRunNumber := 0
+	for _, checkRun := range checkRuns {
+		if int(checkRun.CheckSuite.WorkflowRun.RunNumber) > latestCheckRunNumber {
+			latestCheckRunNumber = int(checkRun.CheckSuite.WorkflowRun.RunNumber)
+		}
+	}
+
+	for _, checkRun := range checkRuns {
+		if int(checkRun.CheckSuite.WorkflowRun.RunNumber) == latestCheckRunNumber {
+			return checkRun, nil
+		}
+	}
+
+	return CheckRun{}, errors.New("theres are not check runs passed")
+}
+
 func CheckRunPassed(checkRun CheckRun) bool {
 	return checkRun.Conclusion == "SUCCESS" || checkRun.Conclusion == "SKIPPED" || checkRun.Conclusion == "NEUTRAL"
 }
@@ -718,11 +737,21 @@ func StatusContextPassed(statusContext StatusContext, vcsstatusname string) bool
 }
 
 func ExpectedCheckPassed(expectedContext githubv4.String, checkRuns []CheckRun, statusContexts []StatusContext, vcsstatusname string) bool {
+	// If there are no WorkflowRuns, we assume there's only one checkRun with the given name.
+	// If there are WorkflowRuns, we assume there can be multiple checkRuns with the given name,
+	// so we retrieve the latest checkRun.
+	matchedCheckRuns := make([]CheckRun, 0)
 	for _, checkRun := range checkRuns {
-		if checkRun.Name == expectedContext {
+		if checkRun.CheckSuite.WorkflowRun == nil {
 			return CheckRunPassed(checkRun)
+		} else if checkRun.Name == expectedContext {
+			matchedCheckRuns = append(matchedCheckRuns, checkRun)
 		}
 	}
+	latestCheckRun, err := GetLatestCheckRun(matchedCheckRuns)
+	if err == nil {
+		return CheckRunPassed(latestCheckRun)
+	}
 
 	for _, statusContext := range statusContexts {
 		if statusContext.Context == expectedContext {
@@ -734,17 +763,24 @@ func ExpectedCheckPassed(expectedContext githubv4.String, checkRuns []CheckRun,
 }
 
 func (g *GithubClient) ExpectedWorkflowPassed(expectedWorkflow WorkflowFileReference, checkRuns []CheckRun) (bool, error) {
+	matchedCheckRuns := make([]CheckRun, 0)
 	for _, checkRun := range checkRuns {
 		if checkRun.CheckSuite.WorkflowRun == nil {
 			continue
+		} else {
+			match, err := g.WorkflowRunMatchesWorkflowFileReference(*checkRun.CheckSuite.WorkflowRun, expectedWorkflow)
+			if err != nil {
+				return false, err
+			}
+			if match {
+				matchedCheckRuns = append(matchedCheckRuns, checkRun)
+			}
 		}
-		match, err := g.WorkflowRunMatchesWorkflowFileReference(*checkRun.CheckSuite.WorkflowRun, expectedWorkflow)
-		if err != nil {
-			return false, err
-		}
-		if match {
-			return CheckRunPassed(checkRun), nil
-		}
+	}
+
+	latestCheckRun, err := GetLatestCheckRun(matchedCheckRuns)
+	if err == nil {
+		return CheckRunPassed(latestCheckRun), nil
 	}
 
 	return false, nil

server/events/vcs/github_client_test.go

@@ -800,6 +800,12 @@ func TestGithubClient_PullIsMergeableWithAllowMergeableBypassApply(t *testing.T)
 			`"APPROVED"`,
 			true,
 		},
+		{
+			"blocked",
+			"ruleset-workflow-passed-multiple-runs.json",
+			`"APPROVED"`,
+			true,
+		},
 		{
 			"blocked",
 			"ruleset-workflow-passed-sha-match.json",

server/events/vcs/testdata/github-pull-request-mergeability/ruleset-evaluate-workflow-failed.json

@@ -78,7 +78,8 @@
                               "path": ".github/workflows/my-required-workflow.yaml",
                               "repositoryFileUrl": "https://github.com/runatlantis/atlantis/blob/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/my-required-workflow.yaml",
                               "repositoryName": "runatlantis/atlantis"
-                            }
+                            },
+                            "runNumber": 1
                           }
                         }
                       }
@@ -92,4 +93,4 @@
       }
     }
   }
-}
+}

server/events/vcs/testdata/github-pull-request-mergeability/ruleset-workflow-failed.json

@@ -78,7 +78,8 @@
                               "path": ".github/workflows/my-required-workflow.yaml",
                               "repositoryFileUrl": "https://github.com/runatlantis/atlantis/blob/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/my-required-workflow.yaml",
                               "repositoryName": "runatlantis/atlantis"
-                            }
+                            },
+                            "runNumber": 1
                           }
                         }
                       }
@@ -92,4 +93,4 @@
       }
     }
   }
-}
+}

server/events/vcs/testdata/github-pull-request-mergeability/ruleset-workflow-passed-multiple-runs.json

@@ -0,0 +1,112 @@
+{
+  "data": {
+    "repository": {
+      "pullRequest": {
+        "reviewDecision": null,
+        "baseRef": {
+          "branchProtectionRule": {
+            "requiredStatusChecks": []
+          },
+          "rules": {
+            "pageInfo": {
+              "endCursor": "QWERTY",
+              "hasNextPage": false
+            },
+            "nodes": [
+              {
+                "type": "REQUIRED_STATUS_CHECKS",
+                "repositoryRuleset": {
+                  "enforcement": "ACTIVE"
+                },
+                "parameters": {
+                  "requiredStatusChecks": [
+                    {
+                      "context": "atlantis/apply"
+                    }
+                  ]
+                }
+              },
+              {
+                "type": "WORKFLOWS",
+                "repositoryRuleset": {
+                  "enforcement": "ACTIVE"
+                },
+                "parameters": {
+                  "workflows": [
+                    {
+                      "path": ".github/workflows/my-required-workflow.yaml",
+                      "repositoryId": 120519269,
+                      "sha": null
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        },
+        "commits": {
+          "nodes": [
+            {
+              "commit": {
+                "statusCheckRollup": {
+                  "contexts": {
+                    "pageInfo": {
+                      "endCursor": "QWERTY",
+                      "hasNextPage": false
+                    },
+                    "nodes": [
+                      {
+                        "__typename": "StatusContext",
+                        "context": "atlantis/apply",
+                        "state": "PENDING",
+                        "isRequired": true
+                      },
+                      {
+                        "__typename": "StatusContext",
+                        "context": "atlantis/plan",
+                        "state": "SUCCESS",
+                        "isRequired": false
+                      },
+                      {
+                        "__typename": "CheckRun",
+                        "name": "my required check",
+                        "conclusion": "FAILURE",
+                        "isRequired": true,
+                        "checkSuite": {
+                          "workflowRun": {
+                            "file": {
+                              "path": ".github/workflows/my-required-workflow.yaml",
+                              "repositoryFileUrl": "https://github.com/runatlantis/atlantis/blob/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/my-required-workflow.yaml",
+                              "repositoryName": "runatlantis/atlantis"
+                            },
+                            "runNumber": 1
+                          }
+                        }
+                      },
+                      {
+                        "__typename": "CheckRun",
+                        "name": "my required check",
+                        "conclusion": "SUCCESS",
+                        "isRequired": true,
+                        "checkSuite": {
+                          "workflowRun": {
+                            "file": {
+                              "path": ".github/workflows/my-required-workflow.yaml",
+                              "repositoryFileUrl": "https://github.com/runatlantis/atlantis/blob/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/my-required-workflow.yaml",
+                              "repositoryName": "runatlantis/atlantis"
+                            },
+                            "runNumber": 2
+                          }
+                        }
+                      }
+                    ]
+                  }
+                }
+              }
+            }
+          ]
+        }
+      }
+    }
+  }
+}

server/events/vcs/testdata/github-pull-request-mergeability/ruleset-workflow-passed-sha-match.json

@@ -78,7 +78,8 @@
                               "path": ".github/workflows/my-required-workflow.yaml",
                               "repositoryFileUrl": "https://github.com/runatlantis/atlantis/blob/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/my-required-workflow.yaml",
                               "repositoryName": "runatlantis/atlantis"
-                            }
+                            },
+                            "runNumber": 1
                           }
                         }
                       }
@@ -92,4 +93,4 @@
       }
     }
   }
-}
+}

server/events/vcs/testdata/github-pull-request-mergeability/ruleset-workflow-passed-sha-mismatch.json

@@ -78,7 +78,8 @@
                               "path": ".github/workflows/my-required-workflow.yaml",
                               "repositoryFileUrl": "https://github.com/runatlantis/atlantis/blob/bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/.github/workflows/my-required-workflow.yaml",
                               "repositoryName": "runatlantis/atlantis"
-                            }
+                            },
+                            "runNumber": 1
                           }
                         }
                       }
@@ -92,4 +93,4 @@
       }
     }
   }
-}
+}

server/events/vcs/testdata/github-pull-request-mergeability/ruleset-workflow-passed.json

@@ -78,7 +78,8 @@
                               "path": ".github/workflows/my-required-workflow.yaml",
                               "repositoryFileUrl": "https://github.com/runatlantis/atlantis/blob/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/.github/workflows/my-required-workflow.yaml",
                               "repositoryName": "runatlantis/atlantis"
-                            }
+                            },
+                            "runNumber": 1
                           }
                         }
                       }
@@ -92,4 +93,4 @@
       }
     }
   }
-}
+}