Enable GitHub pull request limits to cut automation-PR noise #505
Description
Why
Discussion #497 proposes adopting GitHub's pull request limits to cut down the review/CI noise generated by this org's heavy PR automation. Today the only PR cap we run is Dependabot's ecosystem-scoped open-pull-requests-limit: 10 (.github/dependabot.yml); there is no repo- or org-wide ceiling on concurrent open PRs, even though dev-lead, auto-rebase fan-out, and the initiative-driver all open PRs continuously.
What
Research the exact GitHub mechanism (repo setting vs. org setting vs. ruleset rule + its API), encode the limit as settings-as-code in our existing apply mechanism (scripts/apply-repo-settings.sh and/or .github/rulesets/), wire an idempotent apply path that actually enforces it (neither the script nor the ruleset JSON is invoked by any workflow today), document the standard + exemptions, and instrument the noise-reduction metric.
Success metric
Within two weeks of enforcement on the in-scope repo(s): the count of open, non-draft automation-authored PRs per repo stays at or below the configured cap, AND zero legitimate (human or sanctioned-automation) PRs are wrongly refused by the limit. Baseline and post-rollout numbers are measured by the Story 5 report.
Cost / budget bound
This is configuration + CI work, not an LLM runtime loop. Bounded to the ~5 dev-lead story PRs below. The only recurring runtime cost is a single no-LLM, gh-API + jq report capped at <=1 run/day on github.token (Story 5) - no recurring token/LLM spend.
Scope note
Final numeric limit, exempt actors, and rollout breadth (pilot repo vs. org-wide) are human decisions - see open questions; the config is built parameterized so those values are set without a code change.
Untracked prerequisites
- Confirm GitHub 'pull request limits' is generally available on the petry-projects org plan (not gated behind a preview/enterprise-only flag) and whether it exposes a REST/GraphQL API or is UI-only. External GitHub-feature dependency, not a repo issue; resolved and recorded in the Story 1 ADR. Source: https://github.blog/open-source/maintainers/how-pull-request-limits-are-cutting-down-the-noise/
- Human sign-off on the final numeric limit, the exempt-actor list, and the rollout scope before Story 3 flips enforcement on a live repo.
Planned from idea discussion #497 by the BMAD Scrum Master initiative-planner. Inert until a maintainer adds initiative:auto.
Activity
feat: enroll initiative-driver stub on .github (#888 pilot setup) (#530)
don-petry commentedon Jun 27, 2026
✅ Fleet-enablement pilot: initiative-driver auto-released a story cross-repo
Result: PASS — the central
initiative-driverauto-released a not-previously-labeled sub-issue cross-repo with zero manualdev-leadlabeling.What happened (all UTC, 2026-06-27)
initiative:autoadded to Enable GitHub pull request limits to cut automation-PR noise #505 (the only manual mutation; on the epic, not on any story). Note: theinitiative:autogate label did not yet exist on this repo (adoption checklist step 2), so it was created first, then applied.Initiative Driver — Dispatch Centralran on this repo from thelabeledevent and dispatched the central driver withtarget_repo=petry-projects/.github. Run: https://github.com/petry-projects/.github/actions/runs/28290875147 (success).initiative-driverran inpetry-projects/.github-private(workflow_dispatch, success): https://github.com/petry-projects/.github-private/actions/runs/28290877235dev-leadto [Phase 2a] Encode the PR-limit config as a machine-readable single source of truth #507 cross-repo viaGH_PAT_WORKFLOWS— inside the driver's 13s window. [Phase 2a] Encode the PR-limit config as a machine-readable single source of truth #507 was NOT hand-labeled (its blocker [Phase 1] ADR: pull-request-limits mechanism + policy decision #506 was already closed, making it the ready story). [Phase 3] Apply path: enforce the limit on target repo(s) + tests #508/[Phase 3] Document the PR-limits standard + exemption rationale #509/[Phase 4] Measure the noise reduction (success-metric instrumentation) #510 correctly stayed unreleased (stillblocked_byopen issues).Dev-Lead Agentstarted building [Phase 2a] Encode the PR-limit config as a machine-readable single source of truth #507 in this repo (issuesevent from the bot label): https://github.com/petry-projects/.github/actions/runs/28290881508 (in_progress).Key facts
dev-leadlabel 13:39:26).dev-leadlabel on [Phase 2a] Encode the PR-limit config as a machine-readable single source of truth #507 was applied by theGH_PAT_WORKFLOWSworkflow identity at 13:39:26, within the central driver run window. My interactive session only ever labeled Enable GitHub pull request limits to cut automation-PR noise #505 withinitiative:auto; I issued no command touching [Phase 2a] Encode the PR-limit config as a machine-readable single source of truth #507.This validates the full fleet-enabled cascade: per-repo stub → central driver dispatch → cross-repo
dev-leadlabel → repo-localdev-lead.ymlbuild, with no human label hand-off.— pilot
petry-projects/.github-private#888feat(pr-limits): sign off cap at 50 as a single org-wide soft ceiling (…
feat(pr-limits): wire the admission gate into dev-lead-fix-issue.sh (#…
feat(pr-limits): add the no-LLM success-metric report (#510) (#573)
don-petry commentedon Jul 2, 2026
✅ Initiative delivered — all stories merged
All sub-issues are closed and the feature is on
main:docs/initiatives/pull-request-limits-adr.mdstandards/pr-limits.jsonscripts/lib/pr-limit-gate.shpetry-projects/.github-private#1004 → gate wired intodev-lead-fix-issue.shstandards/pr-limits.md+ AGENTS.mdscripts/pr-limits-report.sh+ daily workflowKey design (per the ADR)
GitHub exposes no native max-open-PRs surface, so enforcement is a source-side admission gate + shared config: before dev-lead/initiative automation opens a PR, it counts the open non-draft non-exempt automation queue org-wide (
gh search prs) and defers if at/over the cap. Dependabot + break-glass actors +security-labeled PRs are exempt (never counted, never blocked).Signed-off policy
The gate is merged to
.github-privatemain, but the dev-lead engine runs scripts from thedev-lead/ring0channel — so enforcement activates as this change promotes through the dev-lead channels (ring0 → stable) via the normalcanary-rolloutsoak. It is not yet live-enforcing; riding the standard soak is safe (no-op at 41/50). The dailypr-limits-reportmeasures the metric going forward.Scope note preserved
This cap targets the open-PR-count / CI-churn cost (ADR §1/§5). The recent bot review-comment noise pain is a separate concern already addressed by the advisory-review-gate (#457/#458).
Closing as delivered. Enforcement goes live on channel promotion; the metric is now auto-reported.