Repository navigation
ci: run required checks for merge groups - #524
Conversation
Branch rules require contexts 'Conventional Commit Title', 'Python Lint & Test', and 'Pattern Validation'. ci.yml and pr-lint.yml only fired on pull_request, so PRs entering the merge queue stalled at AWAITING_CHECKS on the merge-group SHA (#523). Changes: - ci.yml: add merge_group trigger (branches: [main]) — satisfies the 'Python Lint & Test' and 'Pattern Validation' required contexts - pr-lint.yml: add merge_group trigger (branches: [main]); gate the amannn/action-semantic-pull-request step to pull_request only via an 'if:' condition; add a no-op echo step for merge_group so the 'Conventional Commit Title' context is reported as succeeded (PR title was already validated before queue entry) No new actions, no new permissions, no new secrets access. All existing pinned SHA references preserved. Closes #523 Co-authored-by: OpenCode Agent <[email protected]>
|
🤖 First Mate handoff: all eight normal PR checks pass and independent adversarial review found no security or correctness blockers. Because the existing merge queue cannot run required merge-group checks until this workflow change is on |
wz-gsa
left a comment
wz-gsa
left a comment
There was a problem hiding this comment.
AI-assisted review by OpenCode (usai/gpt-6-astra) of #524 at a91f241. No blocking findings.
Confirmed the failure mechanism independently: the active main ruleset requires Conventional Commit Title, Python Lint & Test, and Pattern Validation plus merge queue. #522 was first in the queue at AWAITING_CHECKS; its observed queue SHA 9e1c37e had zero check runs, and no merge_group workflow runs were listed. The approved PR-head checks do not satisfy checks on that queue SHA. This is tracked by #523.
Reviewed the full contents of both changed workflows, not only the trigger additions:
- Both workflows subscribe to merge_group for main; the default checks_requested activity is appropriate.
- All three required context names are preserved.
- Normal checkout defaults use the merge-group ref/SHA; no PR-head override was introduced.
- Existing concurrency keys fall back to the queue ref when head_ref is absent and remain separated by workflow name.
- The title job retains its existing pull_request validation and uses a static, token-free shell step for merge_group, without dereferencing the absent PR object.
- Existing permissions and action SHA pins are unchanged. The link-check event expression already selects full checking for non-PR events.
Verification: all eight current-head GitHub checks passed, including zizmor. Local actionlint passes for pr-lint.yml. For ci.yml it reports only SC2016 on the unchanged, deliberately single-quoted envsubst placeholder; the identical warning reproduces on the base SHA. No new actionlint diagnostics. git diff --check passes.
Approval covers the workflow change; successful live merge-group execution is still unmeasured. Keep the queue-progression acceptance criterion open until the required contexts appear and complete on a fresh merge-group SHA, then #522 progresses.
## Summary Fix missing required checks on merge-queue commits: - Add merge_group triggers to PR lint, pre-commit, and Bash 3.2 compatibility workflows. - Run the PR title validator only on PR events; acknowledge previously validated titles on merge groups. - Use the merge-group base SHA for Bash relevance detection, validate the SHA, and preserve fail-closed behavior. Refs: #607 Unblocks: #592 Related fix: GSA-TTS/agentic-coding-patterns#524 ## Verification - PASS: YAML, whitespace, EOF, merge-conflict checks, and git diff --check. - PASS: shell syntax and focused relevance tests covering malformed/missing SHAs, relevant/irrelevant paths, and fetch/diff failures. - PASS: all 16 upstream-result gate combinations. - PASS: adversarial AI subagent review found no blockers. - BLOCKED locally: full pre-commit exhausted disk space while building pinned gitleaks; actionlint unavailable. - Pending: PR CI and all three required contexts reporting on a real merge-group SHA with successful queue progression. ## Security impact Preserves required check names, read-only permissions, pinned actions, and queue-ref concurrency isolation. ## Rollback Revert this commit; doing so restores the missing merge-group checks. ## AI assistance Implemented and reviewed with OpenCode AI agents under the approved three-workflow plan. Human review remains pending.
Summary
Run the required status checks on GitHub merge-queue commits so approved pull requests can leave the queue.
Issue resolved
#523
Before and after
Before this PR: Merge-queue entries waited indefinitely for
Conventional Commit Title,Python Lint & Test, andPattern Validation.After merge: CI runs required validation on merge-group commits, while the title job reports the same required context without invoking PR-only logic.
Verification
ci.ymlowns Python and Pattern checks;pr-lint.ymlowns title checkSecurity impact
Permissions remain read-only. Actions remain SHA-pinned. The merge-group no-op emits a static string and receives no token environment.
Relationships
Fixes: #523
Unblocks: #522
Related epic: #357
Rollback
Revert this PR to remove merge-group workflow triggers.
AI-assisted by OpenCode. Human review required.