Skip to content

ci(requirements-sync): enable auto-merge on nightly sync PRs #876

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
SarahLittlejohn wants to merge 1 commit into from
Closed

ci(requirements-sync): enable auto-merge on nightly sync PRs #876

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/workflows/requirements-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,15 @@ jobs:
`gh pr create` against master. The PR body must summarise the delta: counts of new /
status-changed / impl-changed requirements with their REQ refs, and any
below-the-gate cases noted for a human.

## 8. Enable auto-merge
After the PR exists (whether newly created or the existing one you pushed onto),
enable auto-merge so it lands on master once its status checks pass:
`gh pr merge --auto --squash --delete-branch "<pr-url-or-number>"`.
Auto-merge only completes when the required checks are green, so a migration that
fails the build/integrity gate will never merge. Do not attempt an immediate or
admin merge; if enabling auto-merge fails (e.g. it is not enabled on the repo),
report that in the run output and leave the PR open rather than force-merging.
Comment on lines +196 to +199

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

rg -n 'schedule:|pull_request:|merge_group:|requirements:build|integrity_check|foreign_key_check' .github/workflows

repo=$(gh repo view --json nameWithOwner --jq '.nameWithOwner')
gh api "repos/$repo" --jq '{allow_auto_merge,delete_branch_on_merge}'
gh api "repos/$repo/branches/master/protection/required_status_checks" \
  --jq '{contexts,checks}'

Repository: hmcts/cath-service

Length of output: 1721

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow files =="
find .github/workflows -maxdepth 1 -type f | sort

echo
echo "== triggers and relevant gate references =="
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
  [ -e "$f" ] || continue
  echo "--- $f"
  sed -n '1,5p;200,230p' "$f" | nl -ba
done

echo
echo "== requirements-sync around gate =="
sed -n '160,235p' .github/workflows/requirements-sync.yml | nl -ba

echo
echo "== package scripts =="
if [ -f package.json ]; then
  node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(JSON.stringify(pkg.scripts || {}, null, 2));
JS
fi

echo
echo "== gh auth status =="
gh auth status 2>&1 | head -20 || true

Repository: hmcts/cath-service

Length of output: 1867

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow files count =="
find .github/workflows -maxdepth 1 -type f | wc -l
find .github/workflows -maxdepth 1 -type f | sort

echo
echo "== all workflow triggers and job names =="
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
  [ -e "$f" ] || continue
  echo "--- $f"
  sed -n '1,5p' "$f"
  grep -nE '^\s+[A-Za-z].*:' "$f" | sed -n '1,40p'
done

echo
echo "== requirements-sync triggers and gate section =="
sed -n '1,40p' .github/workflows/requirements-sync.yml
sed -n '160,235p' .github/workflows/requirements-sync.yml

echo
echo "== package scripts if present =="
if [ -f package.json ]; then
  node - <<'JS'
const fs = require('fs');
const pkg = JSON.parse(fs.readFileSync('package.json','utf8'));
console.log(JSON.stringify(pkg.scripts || {}, null, 2));
JS
fi

echo
echo "== repository API summary =="
repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')"
gh api "repos/$repo?fields=allow_auto_merge,default_branch,delete_branch_on_merge,has_issues,has_projects,description" --jq . || true
echo "protected branches list attempted:"
gh api "repos/$repo/branches" --jq '.[].name' 2>/dev/null || true

Repository: hmcts/cath-service

Length of output: 50374

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== requirements-sync full sync job and enable-auto-merge section =="
sed -n '1,240p' .github/workflows/requirements-sync.yml

Repository: hmcts/cath-service

Length of output: 12501

🌐 Web query:

GitHub Actions pull_request event runs workflow from pull request head branch default branch head

💡 Result:

When a workflow is triggered by the pull_request event, it does not run against the head branch directly in the way a push event does [1][2]. Instead, GitHub Actions creates a temporary merge branch—a virtual ref that represents the PR's head branch merged into the base branch [3]. Key details regarding the execution environment for the pull_request event: 1. Execution Ref: The GITHUB_REF for a pull_request event (unless it is a pull_request_target event) is set to refs/pull/<pr_number>/merge, which is the merge branch [3]. 2. Commit SHA: The default GITHUB_SHA for this event corresponds to the last merge commit of this temporary merge branch [1][2]. 3. Head Access: If you require the SHA of the actual head commit of the source branch (the pull request head), you must explicitly use the github.event.pull_request.head.sha context [1][2]. 4. Branch Contexts: You can access the specific branch names using context variables: - github.head_ref: The name of the source (head) branch of the pull request [4][3]. - github.base_ref: The name of the target (base) branch of the pull request [4][3]. These contexts (github.head_ref and github.base_ref) are only available when the workflow is triggered by pull_request or pull_request_target events [4][5][3]. If you need to run a job conditionally based on the head branch name, you can use these variables in an if conditional within your workflow file [1][2].

Citations:

Make the build and integrity gate a required PR check.

This scheduled workflow runs against the default branch before enabling auto-merge, so the gate cannot block a bad PR head here. Move it into a pull_request/merge_group workflow and configure the job name as a required status check so gh pr merge --auto actually prevents a failed migration from landing.

claude_args: |
--dangerously-skip-permissions
--append-system-prompt "You are running in a scheduled GitHub Action to sync the requirements database. Read @CLAUDE.md and the requirements/ SQL files. Be precise: this is an append-only audit log. If there is no drift, do nothing and open no PR. Never hard-delete or down-status a requirement."
Expand Down
Loading