57 lines
2.7 KiB
YAML
57 lines
2.7 KiB
YAML
# Safety net (OPS71 — GitHub): every same-repo PR to main must be Ready +
|
|
# auto-merge armed. Covers Cloud ManagePullRequest defaulting to draft,
|
|
# agents that forget to arm the merge, and human/worktree PRs (the OPS52
|
|
# incident was a human PR whose merge failed silently). Draft PRs from
|
|
# non-`cursor/*` branches are never touched — the draft flag is the actor's
|
|
# veto (the CLI skips them). Fork PRs are excluded (the repo is public; a
|
|
# merged fork PR would deploy) — same RCE-guard class as the other workflows.
|
|
#
|
|
# GitHub's NATIVE auto-merge replaces the Forgejo-era poll CLI
|
|
# (forgejo-pr-automerge.mjs): `enablePullRequestAutoMerge` (GraphQL, REBASE —
|
|
# the repo's canonical merge style) is server-side — GitHub only merges when
|
|
# every required check (the `CI (PR) / checks` rollup of ci-pr.yml, OPS62) is
|
|
# green and the PR is mergeable. The OPS64 "rollup can lie" defense is
|
|
# structural here: a single sequential job posts one honest check-run and the
|
|
# server enforces it — nothing to poll, nothing to trust.
|
|
#
|
|
# Permissions: contents+pull-requests write — enough for PATCH draft:false
|
|
# and the GraphQL auto-merge mutation with the built-in GITHUB_TOKEN.
|
|
name: PR Ready + auto-merge
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
ready-automerge:
|
|
# Same-repo only. This MUST stay in the `if:` (pre-checkout): for a fork
|
|
# PR, actions/checkout checks out the fork's head, so a same-repo guard
|
|
# inside the CLI would already be running the fork's own script — RCE
|
|
# with the Actions token. The draft policy lives in the CLI (skips
|
|
# non-`cursor/*` drafts) because there the PR state is re-read from the
|
|
# API, not from webhook payload fields.
|
|
if: >-
|
|
github.event.pull_request.state == 'open' &&
|
|
github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@v5
|
|
# Script is plain Node (stdlib) — no pnpm. Disable package-manager-cache:
|
|
# setup-node@v5 defaults to true and looks for pnpm before pnpm/action-setup.
|
|
- uses: actions/setup-node@v5
|
|
with:
|
|
node-version: 24
|
|
package-manager-cache: false
|
|
- name: Mark Ready and arm auto-merge
|
|
env:
|
|
# Explicit `github.token` — the built-in GITHUB_TOKEN env is not
|
|
# guaranteed to be injected on every event path; passing it via the
|
|
# documented context is the robust form.
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: node scripts/github-pr-automerge.mjs --pr "${{ github.event.pull_request.number }}"
|