gated_merge: don't merge without a green CI signal; use --auto on branch-policy block#10
Merged
Merged
Conversation
…icy block
Two fixes for the failure seen on RealRate-Private#2220, where the log showed:
"No CI checks registered within 180s; merging on the existing signal."
"... is not mergeable: the base branch policy prohibits the merge.
... add the `--auto` flag."
Root cause: under runner-queue contention (a batch of Dependabot PRs), the
target repo's CI checks had not *registered* within the 180s appearance grace,
so the script fell through to "merge on the existing signal" and attempted an
immediate merge before any CI existed -- which the base-branch ruleset correctly
rejected (its required workflow/checks were not yet satisfied).
Fix 1 -- never merge blind: if no checks register within the grace window, route
to a human instead of merging. Skipping the gate exactly when checks are merely
delayed defeats its purpose. Also raise the grace 180s -> 300s to absorb queue
delays.
Fix 2 -- respect the branch policy: do_merge now tries an immediate merge and, if
the ruleset prohibits it ("add the --auto flag"), enables --auto so GitHub
completes the merge once requirements are met. Our checks are already green at
that point, so --auto defers to the branch policy without skipping CI. Any other
rejection still routes to a human, now with the actual gh error text.
shellcheck clean; regex verified against the real error message.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Follow-up to #9. On
RealRate-Private#2220(a minor github-actions bump),gated_merge.shheld the PR even though it was clean and green. The run log gave the exact cause:Root cause: a batch of Dependabot PRs was rebased at once, so under runner-queue contention #2220's CI checks hadn't registered within the 180s appearance grace. The script then fell through to "merge on the existing signal" and attempted an immediate merge before any CI existed — which
develop's ruleset correctly rejected (its required workflow/checks weren't satisfied yet). The gate fail-safed toneeds-manual-review. (The other 6 PRs' checks registered in time, so they waited-for-green and merged normally.)Two design flaws, both fixed:
Fix 1 — never merge without a green signal
The "no checks in Ns → merge anyway" fallback skips the CI gate exactly when checks are merely delayed. Changed it to route to a human if nothing registers, and raised the grace
180s → 300sto absorb queue delays. A genuinely no-CI repo now also routes to a human rather than auto-merging unverified — the safe default.Fix 2 — respect the branch policy with
--autodo_mergenow tries an immediate merge and, if the ruleset prohibits it (add the --auto flag), enables--autoso GitHub completes the merge once the policy's requirements are met. Our checks are already green at that point, so--autoonly defers to the branch policy — it does not skip CI. Any other rejection still routes to a human, now surfacing the actualgherror text instead of a generic guess.Validation
shellcheckclean.--auto-fallback regex verified against the real error string (matches → falls back to--auto).Refs: RealRate-Private#2229 / #2244. Fixes the #2220-class hold.
🤖 Generated with Claude Code