Auto-merge #1177
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Auto-merge — nobody is in the merge loop. | |
| # | |
| # Green, ready PRs merge themselves and deploy themselves. The owner does not | |
| # review PRs, and agent sessions are barred from merging by hand, so the policy | |
| # lives in scripts/ci/auto-merge-sweep.sh (read it — it defines exactly what | |
| # "ready" means and how a PR is held back). | |
| # | |
| # Two triggers, deliberately: | |
| # workflow_run — merges within seconds of CI going green (the common path). | |
| # schedule — a safety net. Catches PRs whose checks finished while this | |
| # workflow was failing/disabled, and PRs whose last check was | |
| # an external status (Snyk/CodeQL) that reported after CI. | |
| # Without it, a PR that went green "off-cycle" waits forever. | |
| # | |
| # To stop all of this: delete this file, or add a `hold` label to a PR. | |
| name: Auto-merge | |
| on: | |
| workflow_run: | |
| workflows: ['CI'] | |
| types: [completed] | |
| schedule: | |
| - cron: '*/10 * * * *' | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: write # merge the PR | |
| pull-requests: write # read PR state, delete the branch | |
| actions: write # dispatch CI on main to re-arm CD | |
| # Never let two sweeps merge concurrently — they would race on the same PRs. | |
| concurrency: | |
| group: auto-merge | |
| cancel-in-progress: false | |
| jobs: | |
| sweep: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Merge every green, ready PR | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| run: bash scripts/ci/auto-merge-sweep.sh |