Skip to content

ci(contributors): enable auto-merge instead of forcing --admin#6340

Merged
houko merged 2 commits into
mainfrom
ci/contributors-auto-merge
Jun 26, 2026
Merged

ci(contributors): enable auto-merge instead of forcing --admin#6340
houko merged 2 commits into
mainfrom
ci/contributors-auto-merge

Conversation

@houko

@houko houko commented Jun 26, 2026

Copy link
Copy Markdown
Contributor

Problem

The daily Update Contributors & Star History workflow's Auto-merge PR step fails every run (e.g. run 28233594935):

GraphQL: Repository rule violations found
Required status check "CI Gate" is expected.
 (mergePullRequest)

Two independent root causes, both confirmed against the live repo config:

  1. --admin cannot bypass the main ruleset. The ruleset requires the CI Gate status check and its bypass_actors list is empty, so no actor — not even an admin token — can force the merge while CI Gate is still in the expected (unreported) state.

  2. CI Gate never runs on the PR on its own. The PR was created with the default GITHUB_TOKEN, and branch pushes made by GITHUB_TOKEN do not trigger on: pull_request workflows (GitHub's recursion guard). So CI Gate stays expected forever, and a maintainer had to manually re-trigger CI and merge by hand each day (PR docs: update contributors and star history #6337 was merged manually by a human at 11:43, ~48 min after the bot's failed attempt).

Fix

  • Create the PR with the WEBSITE_REPO_TOKEN PAT instead of the default GITHUB_TOKEN, so the push triggers on: pull_request CI and CI Gate actually runs.
  • Replace gh pr merge --admin with gh pr merge --auto. GitHub squash-merges the PR automatically once CI Gate passes (the ruleset requires 0 approvals and allows the squash method), respecting the ruleset instead of fighting it.

Net effect: the daily contributors/star-history update merges itself with no manual intervention.

Verification

  • python3 -c "import yaml; yaml.safe_load(...)" — workflow YAML parses.
  • Ruleset confirmed via gh api repos/librefang/librefang/rulesets/13809063: single required check CI Gate, bypass_actors: [], required_approving_review_count: 0, allowed_merge_methods includes squash.
  • Repo settings confirmed: allow_auto_merge: true, allow_squash_merge: true, delete_branch_on_merge: true.
  • WEBSITE_REPO_TOKEN confirmed present in repo secrets.
  • This is a workflow-only change; full validation is the next scheduled (or workflow_dispatch) run of the job.

The daily "Update Contributors & Star History" job created its PR with the
default GITHUB_TOKEN and then ran `gh pr merge --admin`. Both halves were
broken:

- The `main` ruleset requires the "CI Gate" status check and its
  bypass_actors list is empty, so no actor — not even with --admin — can
  bypass it. The merge failed with "Required status check 'CI Gate' is
  expected" because CI had not reported yet.
- Branch pushes made by GITHUB_TOKEN do not trigger `on: pull_request`
  workflows, so CI Gate never ran on the PR on its own; a human had to
  re-trigger CI and merge by hand every day.

Create the PR with the WEBSITE_REPO_TOKEN PAT so the push triggers CI, and
enable auto-merge (--auto) so GitHub squash-merges once CI Gate passes
(0 approvals required). No more daily manual intervention.
@github-actions github-actions Bot added size/S 10-49 lines changed area/ci CI/CD and build tooling no-rust-required This task does not require Rust knowledge labels Jun 26, 2026
@houko
houko enabled auto-merge (squash) June 26, 2026 12:00
@houko
houko merged commit 69e685a into main Jun 26, 2026
31 checks passed
@houko
houko deleted the ci/contributors-auto-merge branch June 26, 2026 12:56
@houko houko mentioned this pull request Jun 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/ci CI/CD and build tooling no-rust-required This task does not require Rust knowledge size/S 10-49 lines changed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant