From 0d1bd52df0e5e49a2e406a9cd57b3dc957ec98c2 Mon Sep 17 00:00:00 2001
From: Gutierrez Soto Jhosepmyr Orlando <jhosepmyrgutierrezsoto@gmail.com>
Date: Mon, 12 Oct 2026 20:12:41 -0500
Subject: [PATCH] fix(ci): list a branch's pull requests with GET in the branch
 cleanup

Closes #147
---
 .github/workflows/branch-cleanup.yml | 11 +++++++++--
 CHANGELOG.md                         |  3 +++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/branch-cleanup.yml b/.github/workflows/branch-cleanup.yml
index 7aa22a9e..da715e1d 100644
--- a/.github/workflows/branch-cleanup.yml
+++ b/.github/workflows/branch-cleanup.yml
@@ -96,8 +96,15 @@ jobs:
                 ;;
             esac
 
-            # Pull this branch's full PR history (open + closed + merged) in one call.
-            prs_json=$(gh api "repos/$REPO/pulls" -f "head=$OWNER:$branch" -f state=all --jq '.' 2>/dev/null || echo '[]')
+            # Pull this branch's full PR history (open + closed + merged) in one call. --method GET is
+            # required: gh api sends -f fields as a POST body unless told otherwise, which would hit the
+            # create-a-pull-request endpoint instead of listing. When the lookup fails the branch is left
+            # alone: without its PRs the open-PR and protect-label rules cannot be checked.
+            if ! prs_json=$(gh api --method GET "repos/$REPO/pulls" -f "head=$OWNER:$branch" -f state=all -f per_page=100 2>/dev/null); then
+              row "$branch" "Kept" "PR lookup failed" "left alone: its PRs could not be read"
+              kept=$((kept + 1))
+              continue
+            fi
 
             has_open=$(echo "$prs_json" | jq -r 'any(.[]; .state == "open")')
             if [ "$has_open" = "true" ]; then
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ad638edb..25a0b169 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,9 @@ follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+### Fixed (Branch cleanup — `bugfix/147-branch-cleanup-pulls`, #147)
+- The weekly branch cleanup read each branch's pull requests with `gh api -f`, which sends a POST to the create-pull-request endpoint instead of listing, so every lookup failed with 422 and the open-PR and `do-not-delete` protections were never checked. It now lists with `--method GET`, and a branch whose PRs cannot be read is left alone.
+
 ### Added (Source profile data — `feature/145-source-profile`, #145)
 - `GET .../integrations/{connectionId}/jira/projects` returns each project's `description` and `GET .../code/github/repositories` each repository's `language`, so the create-project wizard can fill the project's profile from the chosen sources.