Phil/forgejo-mcp
1
0
Fork 0
Code Issues 4 Pull requests 2 Projects Releases Packages Wiki Activity Actions

dispatch_workflow: response-decode error returned after the workflow already fired → false-negative re-dispatch risk #7

New issue
Open
opened 2026-06-17 09:07:31 +00:00 by Phil · 0 comments
Phil commented 2026-06-17 09:07:31 +00:00
Owner
Copy link

Severity: HIGH (silent-wrong with side-effect)

Symptom (reproduced live 2026-06-17)

dispatch_workflow(workflow="api-tests.yml", ref="<branch>") returns:

MCP error -32603: failed to dispatch workflow: json: cannot unmarshal string into Go struct field DispatchWorkflowResponse.jobs of type forgejo.ActionRunJob

But the workflow DID fire — verified: run id=6567 / #4915 "API tests" was created at 08:33Z on the branch tip, a third run beyond the two original push runs. The POST landed; only the run-info read-back failed to decode.

Why this is dangerous

The error makes the caller believe the dispatch failed → it re-fires → duplicate runs. Combined with the list_workflow_runs stale-page bug (separate issue), the fresh run is also invisible in the listing, so the caller can't even confirm it landed.

Fix — already written, just unmerged

Commit d8e1700 on branch fix/dispatch-tolerate-runinfo-decode fixes this correctly: it treats any DispatchWorkflowResponse decode error the same as the existing 204 path (dispatch landed, handle unreadable → fall back to the Actions-list summary). Needs a PR → merge to main + release. No code rewrite required.

Found by the forgejo-mcp tool-call forensic audit, 2026-06-17.

## Severity: HIGH (silent-wrong with side-effect) ## Symptom (reproduced live 2026-06-17) `dispatch_workflow(workflow="api-tests.yml", ref="<branch>")` returns: ``` MCP error -32603: failed to dispatch workflow: json: cannot unmarshal string into Go struct field DispatchWorkflowResponse.jobs of type forgejo.ActionRunJob ``` **But the workflow DID fire** — verified: run `id=6567 / #4915 "API tests"` was created at 08:33Z on the branch tip, a third run beyond the two original push runs. The POST landed; only the run-info read-back failed to decode. ## Why this is dangerous The error makes the caller believe the dispatch failed → it re-fires → duplicate runs. Combined with the `list_workflow_runs` stale-page bug (separate issue), the fresh run is also invisible in the listing, so the caller can't even confirm it landed. ## Fix — already written, just unmerged Commit `d8e1700` on branch `fix/dispatch-tolerate-runinfo-decode` fixes this correctly: it treats any `DispatchWorkflowResponse` decode error the same as the existing 204 path (dispatch landed, handle unreadable → fall back to the Actions-list summary). Needs a PR → merge to `main` + release. No code rewrite required. Found by the forgejo-mcp tool-call forensic audit, 2026-06-17.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/merge-e2e-gate
ci/release-philflow
feat/runs-jobs-artifacts-tools
feat/run-logs
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Phil/forgejo-mcp#7
No description provided.