Auto-merge #90
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Auto-merge — nobody is in the merge loop. | |
| # | |
| # Green, ready PRs merge themselves and deploy themselves. The owner does not | |
| # review PRs, and background-job agent sessions are barred from merging by hand, | |
| # so the policy lives in scripts/ci/auto-merge-sweep.sh (read it — it defines | |
| # exactly what "ready" means and how a PR is held back). | |
| # | |
| # Two triggers, deliberately: | |
| # workflow_run — merges within seconds of CI going green (the common path). | |
| # schedule — a safety net. Catches PRs whose checks finished while this | |
| # workflow was failing/disabled, and PRs whose last check was | |
| # an external status that reported after CI. Without it, a PR | |
| # that went green "off-cycle" waits forever. | |
| # | |
| # To stop all of this: delete this file, or add a `hold` label to a PR. | |
| name: Auto-merge | |
| on: | |
| workflow_run: | |
| workflows: ['CI'] | |
| types: [completed] | |
| schedule: | |
| - cron: '*/10 * * * *' | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: write # merge the PR | |
| pull-requests: write # read PR state, delete the branch | |
| actions: write # dispatch the re-arm workflows | |
| # Only load-bearing on a PRIVATE repo — which is exactly why this was missing | |
| # for so long. The sweep asks for statusCheckRollup to decide whether a PR is | |
| # green; a public repo answers that with no explicit scope, so this file was | |
| # copied into ~20 repos and worked in every one of them. The first private | |
| # repo to run it (ivy-portal) failed on every single sweep with | |
| # GraphQL: Resource not accessible by integration | |
| # (repository.pullRequests.nodes.0.statusCheckRollup...) | |
| # and merged nothing, ever. Keep these two lines when copying this file: a | |
| # repo that merges nothing is indistinguishable from a repo with nothing to | |
| # merge, so the next occurrence would also go unnoticed. | |
| checks: read # check-run conclusions (CI jobs) | |
| statuses: read # commit statuses (external reporters) | |
| # Never let two sweeps merge concurrently — they would race on the same PRs. | |
| concurrency: | |
| group: auto-merge | |
| cancel-in-progress: false | |
| jobs: | |
| sweep: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Merge every green, ready PR | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| BASE_BRANCH: ${{ github.event.repository.default_branch }} | |
| CI_WORKFLOW: ci.yml | |
| # Everything that runs on push and therefore would NOT fire after a | |
| # merge made with the default GITHUB_TOKEN. Keep this in sync when a | |
| # push-triggered workflow is added. | |
| REARM_WORKFLOWS: ci.yml | |
| run: bash scripts/ci/auto-merge-sweep.sh |