ci(auto-merge): arm auto-merge unattended when ci goes green - #642
Merged
Conversation
auto-merge had two arming surfaces, both requiring the owner to act: the auto-merge label and the /auto-merge comment. green ci triggered nothing, and deauthorize-on-push voids arming on every contributor push — so a PR like #626 was armed twice and disarmed twice by force-pushes, then sat clean and green with no one left to re-arm it. add a third arming path with no human in it. on `ci` completing green for a pull request, resolve the PR from the head sha, confirm it still sits on that sha and is open and undrafted, wait for every other check run on the sha to finish, and refuse if any of them failed — `ci` is only one of the workflows a PR runs, and `test` has no branch protection to wait on the rest. the bars are unchanged. arming still goes through arm-auto-merge.yml, so full diff coverage of changed python under src/vouch/ and a closing reference to an issue plind-junior opened are both still required. the owner-issue link is read once up front here too, silently: arm-auto-merge comments when a PR misses that bar, which is right for a human who just asked to arm and would be per-push noise unattended. no checkout, no PR code — only metadata, since the arming job holds a write token. workflow_run resolves this file from the default branch, so it takes effect once it reaches main, not on merge to test.
github-actions
Bot
added
ci
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
auto-mergelabel and the/auto-mergecomment, both owner-driven. combined withdeauthorize-on-push, a contributor force-push silently disarmed a PR and nobody re-armed it (fix(digest): drop archived pages from followups-due #626 was armed and disarmed twice).ci-auto-merge.yml: oncicompleting green for a PR, wait for every other check run on that head sha and arm native auto-merge if none failed.arm-auto-merge.yml, so 100% diff coverage of changed python undersrc/vouch/and a closing reference to an issue plind-junior opened are both still required.Notes
ciis one of several workflows on a PR andtesthas no branch protection, so the job waits out all check runs itself rather than trusting required-checks.arm-auto-mergecomments on that bar, which is right for a human arming and would be per-push noise unattended.workflow_runresolves the workflow file from the default branch, so this takes effect once it reachesmain.Test plan
zizmor --persona regular .github/workflows/cleanrun:block parses underbash -ntest