Repository navigation
fix(guardrails): fail open with a notice for a literal PR id merge mutation when gh is missing (#6463 item 5) #7376
Description
Refs: #6463
Problem
#7056 shipped block-unresolved-pr-merge fail-closed when gh is missing or unauthenticated and the command is a GraphQL merge mutation (mergePullRequest, enablePullRequestAutoMerge or enqueuePullRequest) carrying a literal PR_ id. The owner's recorded decision on #6463 (2026-10-13, PR item 5) was option B: fail open with the two-channel "not checked" notice for a literal id, and fail closed only for a non-literal id. That matches #6463's acceptance bullet 4, which says the guard fails open with a visible warning when gh is missing or unauthenticated.
The edit was not made in #7056: the auto-mode classifier refused it as a security weakening, so it needs the owner to approve or make it.
Fix
In plugins/guardrails/hooks/block-unresolved-pr-merge.sh, when gh is missing or unauthenticated and the merge mutation's id is a literal PR_... value, let the command through and post the notice on both channels. Keep fail-closed for a non-literal id ($(...), a variable, or a file reference). Add contract cases for both shells: literal id with gh missing passes with the notice, and non-literal id with gh missing still blocks. Each case fails before the fix.
Done when
-
scripts/run-test-file.sh plugins/guardrails/hooks/block-unresolved-pr-merge.test.shpasses, with a new case for each shell: a literalPR_...id merge mutation with gh missing or unauthenticated exits 0 and both "not checked" notices appear. - A new case in the same file: a non-literal id (
$(...), a variable, or a file reference) under the same conditions still blocks. - Each new case fails against the hook on main before the fix.
-
scripts/check-changelog-fragments.shpasses.
Related
- feat(guardrails): block gh pr merge and gh pr ready while a PR has unresolved review threads or failing checks #6463 (closed by feat(guardrails): block a PR merge while review threads, change requests or failing checks remain #7056), decision comment of 2026-10-13
- feat(guardrails): block a PR merge while review threads, change requests or failing checks remain #7056
Activity
github-actions commentedon Oct 13, 2026
Proposed work class: work-class: scoped
Basis: automated intake triage; the lanes App applied this class.
Size: Small
Complexity: Low
Uncertainty: Known
Flags: none
Understood: change
block-unresolved-pr-merge.shso that, when gh is missing or unauthenticated, a merge mutation with a literalPR_...id passes with the two-channel "not checked" notice. A non-literal id still blocks. Add contract cases for both shells, each failing before the fix. The issue also asks for a changelog fragment check to pass. The issue links the owner's decision on #6463, so nothing is missing. The existing hold on this issue says the PR body must carry 'Hold: a human merges this'. I found no likely duplicates.Automated triage, applied by the lanes App.
kyle-sexton commentedon Oct 13, 2026
Owner ratified this admission in an attended session on 2026-10-13: work-class: scoped. It touches a guard, CI script, settings or trust surface, so an agent may build it but the owner merges the PR: put 'Hold: a human merges this' in the PR body.
kyle-sexton commentedon Oct 14, 2026
This was generated by AI during triage.
Triage (work-loop intake sweep): this item already carries the owner's routing decision (
agent-ready+work-class: scoped, applied by the owner, with the attended ratification comment of 2026-10-13). The bot-appliedneeds-triagemarker is stale beside that routed state, so it is cleared; no other label changes. The owner's merge hold stands: the PR body must carry 'Hold: a human merges this'.kyle-sexton commentedon Oct 24, 2026
Released by the owner's HITL session (2026-10-24, C12): it waited only on a removed gate. Intake triage re-runs on it to set its fields, then admission takes it.