ci(requirements-sync): enable auto-merge on nightly sync PRs - #876
ci(requirements-sync): enable auto-merge on nightly sync PRs#876SarahLittlejohn wants to merge 1 commit into
Conversation
Add a step 8 to the requirements-sync prompt instructing Claude to enable auto-merge (--auto --squash --delete-branch) on the sync PR after it is created or updated. Auto-merge only completes once the PR's required status checks (including the independent build & integrity gate) pass, so a bad migration can never merge itself. Immediate/admin merge is explicitly disallowed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe requirements-sync workflow prompt now instructs Claude to enable squash auto-merge for the synchronisation pull request, wait for required checks, and report failures without force-merging. ChangesRequirements sync workflow
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 56ccd708-093b-4a41-bf3c-225bde793ab0
📒 Files selected for processing (1)
.github/workflows/requirements-sync.yml
| Auto-merge only completes when the required checks are green, so a migration that | ||
| fails the build/integrity gate will never merge. Do not attempt an immediate or | ||
| admin merge; if enabling auto-merge fails (e.g. it is not enabled on the repo), | ||
| report that in the run output and leave the PR open rather than force-merging. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
rg -n 'schedule:|pull_request:|merge_group:|requirements:build|integrity_check|foreign_key_check' .github/workflows
repo=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
gh api "repos/$repo" --jq '{allow_auto_merge,delete_branch_on_merge}'
gh api "repos/$repo/branches/master/protection/required_status_checks" \
--jq '{contexts,checks}'Repository: hmcts/cath-service
Length of output: 1721
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== workflow files =="
find .github/workflows -maxdepth 1 -type f | sort
echo
echo "== triggers and relevant gate references =="
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -e "$f" ] || continue
echo "--- $f"
sed -n '1,5p;200,230p' "$f" | nl -ba
done
echo
echo "== requirements-sync around gate =="
sed -n '160,235p' .github/workflows/requirements-sync.yml | nl -ba
echo
echo "== package scripts =="
if [ -f package.json ]; then
node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(JSON.stringify(pkg.scripts || {}, null, 2));
JS
fi
echo
echo "== gh auth status =="
gh auth status 2>&1 | head -20 || trueRepository: hmcts/cath-service
Length of output: 1867
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== workflow files count =="
find .github/workflows -maxdepth 1 -type f | wc -l
find .github/workflows -maxdepth 1 -type f | sort
echo
echo "== all workflow triggers and job names =="
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -e "$f" ] || continue
echo "--- $f"
sed -n '1,5p' "$f"
grep -nE '^\s+[A-Za-z].*:' "$f" | sed -n '1,40p'
done
echo
echo "== requirements-sync triggers and gate section =="
sed -n '1,40p' .github/workflows/requirements-sync.yml
sed -n '160,235p' .github/workflows/requirements-sync.yml
echo
echo "== package scripts if present =="
if [ -f package.json ]; then
node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(JSON.stringify(pkg.scripts || {}, null, 2));
JS
fi
echo
echo "== repository API summary =="
repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
gh api "repos/$repo?fields=allow_auto_merge,default_branch,delete_branch_on_merge,has_issues,has_projects,description" --jq . || true
echo "protected branches list attempted:"
gh api "repos/$repo/branches" --jq '.[].name' 2>/dev/null || trueRepository: hmcts/cath-service
Length of output: 50374
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== requirements-sync full sync job and enable-auto-merge section =="
sed -n '1,240p' .github/workflows/requirements-sync.ymlRepository: hmcts/cath-service
Length of output: 12501
🌐 Web query:
GitHub Actions pull_request event runs workflow from pull request head branch default branch head
💡 Result:
When a workflow is triggered by the pull_request event, it does not run against the head branch directly in the way a push event does [1][2]. Instead, GitHub Actions creates a temporary merge branch—a virtual ref that represents the PR's head branch merged into the base branch [3]. Key details regarding the execution environment for the pull_request event: 1. Execution Ref: The GITHUB_REF for a pull_request event (unless it is a pull_request_target event) is set to refs/pull/<pr_number>/merge, which is the merge branch [3]. 2. Commit SHA: The default GITHUB_SHA for this event corresponds to the last merge commit of this temporary merge branch [1][2]. 3. Head Access: If you require the SHA of the actual head commit of the source branch (the pull request head), you must explicitly use the github.event.pull_request.head.sha context [1][2]. 4. Branch Contexts: You can access the specific branch names using context variables: - github.head_ref: The name of the source (head) branch of the pull request [4][3]. - github.base_ref: The name of the target (base) branch of the pull request [4][3]. These contexts (github.head_ref and github.base_ref) are only available when the workflow is triggered by pull_request or pull_request_target events [4][5][3]. If you need to run a job conditionally based on the head branch name, you can use these variables in an if conditional within your workflow file [1][2].
Citations:
- 1: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
- 2: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
- 3: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
- 4: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/contexts.md
- 5: https://github.com/github/docs/blob/main/content/actions/reference/workflows-and-actions/variables.md
Make the build and integrity gate a required PR check.
This scheduled workflow runs against the default branch before enabling auto-merge, so the gate cannot block a bad PR head here. Move it into a pull_request/merge_group workflow and configure the job name as a required status check so gh pr merge --auto actually prevents a failed migration from landing.
🎭 Playwright E2E Test Results84 tests 52 ✅ 3m 47s ⏱️ Results for commit bcc6e37. |
1 participant
Summary
Enables auto-merge on the nightly requirements-sync PRs so they land on
masterwithout manual clicking, now that the duplicate-migration dedup issue has been fixed.Adds a step 8 to the
requirements-sync.ymlClaude prompt: after the sync PR is created or updated, rungh pr merge --auto --squash --delete-branch.Behaviour
PRAGMA integrity_check/foreign_key_checkcan never merge itself.--adminmerges are explicitly disallowed in the prompt.Bash(gh:*)is already in--allowedTools, so no tool-permission change was needed.Prerequisites (repo settings)
For
--autoto actually gate on checks, the repo needs:masterwith the sync workflow's checks marked as required.Without required checks,
--automerges as soon as GitHub allows (effectively immediately).🤖 Generated with Claude Code
Summary by CodeRabbit