fix: disable Claude + CodeRabbit auto-trigger check suites to unblock auto-merge

scripts/apply-repo-settings.sh

@@ -36,6 +36,13 @@ ok()    { echo "[OK]    $*"; }
 err()   { echo "[ERROR] $*" >&2; }
 skip()  { echo "[SKIP]  $*"; }
 
+# App IDs whose auto_trigger_checks must be disabled — these apps create
+# orphaned "queued" suites on every push that are never completed, permanently
+# blocking GitHub auto-merge.
+# 1236702 = Claude (anthropics/claude-code-action)
+# 347564  = CodeRabbit
+CHECK_SUITE_APP_IDS=(1236702 347564)
+
 # Source the shared push-protection library — provides
 # pp_apply_security_and_analysis() and the PP_REQUIRED_SA_SETTINGS list.
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -226,6 +233,56 @@ apply_codeql_default_setup() {
   fi
 }
 
+# ---------------------------------------------------------------------------
+# apply_check_suite_prefs — disable auto-trigger check suites for Claude and
+# CodeRabbit. Without this, GitHub auto-creates "queued" suites on every push
+# that are never completed, permanently blocking auto-merge.
+# ---------------------------------------------------------------------------
+apply_check_suite_prefs() {
+  local repo="$1"
+  info "Configuring check-suite auto-trigger preferences for $ORG/$repo ..."
+
+  local prefs
+  prefs=$(gh api "repos/$ORG/$repo/check-suites/preferences" 2>/dev/null || true)
+  if [ -z "$prefs" ]; then
+    warn "  Could not read check-suite preferences for $repo — skipping"
+    return 0
+  fi
+
+  local all_disabled=true
+  for app_id in "${CHECK_SUITE_APP_IDS[@]}"; do
+    local setting
+    setting=$(echo "$prefs" | jq -r --argjson id "$app_id" \
+      '.preferences.auto_trigger_checks // [] | map(select(.app_id == $id)) | first | .setting // "missing"')
+    if [ "$setting" != "false" ]; then
+      all_disabled=false
+    fi
+  done
+
+  if [ "$all_disabled" = true ]; then
+    ok "$ORG/$repo check-suite prefs already correct"
+    return 0
+  fi
+
+  if [ "${DRY_RUN:-false}" = "true" ]; then
+    skip "DRY_RUN — skipping check-suite prefs PATCH for $repo"
+    return 0
+  fi
+
+  local payload
+  payload=$(printf '%s\n' "${CHECK_SUITE_APP_IDS[@]}" | \
+    jq -Rs 'split("\n") | map(select(. != "")) | map(tonumber) |
+             {"auto_trigger_checks": map({"app_id": ., "setting": false})}')
+
+  if gh api -X PATCH "repos/$ORG/$repo/check-suites/preferences" \
+       --input - <<< "$payload" > /dev/null; then
+    ok "  auto-trigger disabled for app_ids: ${CHECK_SUITE_APP_IDS[*]}"
+  else
+    warn "  PATCH failed for $repo — manual fix required"
+    return 1
+  fi
+}
+
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -263,6 +320,7 @@ if [ "$1" = "--all" ]; then
     apply_labels "$repo"
     pp_apply_security_and_analysis "$repo" || failed=$((failed + 1))
     apply_codeql_default_setup "$repo" || failed=$((failed + 1))
+    apply_check_suite_prefs "$repo" || failed=$((failed + 1))
   done
 
   if [ "$failed" -gt 0 ]; then
@@ -282,4 +340,5 @@ else
   apply_labels "$1"
   pp_apply_security_and_analysis "$1"
   apply_codeql_default_setup "$1"
+  apply_check_suite_prefs "$1"
 fi

scripts/compliance-audit.sh

@@ -52,6 +52,11 @@ REQUIRED_LABEL_SPECS=(
   "in-progress:fbca04:An agent is actively working this issue"
 )
 
+# App IDs whose auto_trigger_checks must be disabled org-wide.
+# 1236702 = Claude (anthropics/claude-code-action)
+# 347564  = CodeRabbit
+CHECK_SUITE_APP_IDS=(1236702 347564)
+
 REQUIRED_SETTINGS_BOOL=(
   "allow_auto_merge:true:warning:Allow auto-merge must be enabled for Dependabot workflow"
   "delete_branch_on_merge:true:warning:Automatically delete head branches must be enabled"
@@ -853,6 +858,35 @@ check_agents_md() {
   fi
 }
 
+# ---------------------------------------------------------------------------
+# Check: check-suite auto-trigger disabled for Claude and CodeRabbit
+# ---------------------------------------------------------------------------
+check_check_suite_prefs() {
+  local repo="$1"
+
+  local prefs
+  prefs=$(gh_api "repos/$ORG/$repo/check-suites/preferences" 2>/dev/null || true)
+  [ -z "$prefs" ] && return  # non-fatal if API unavailable
+
+  for app_id in "${CHECK_SUITE_APP_IDS[@]}"; do
+    local setting
+    setting=$(echo "$prefs" | jq -r --argjson id "$app_id" \
+      '.preferences.auto_trigger_checks // [] | map(select(.app_id == $id)) | first | .setting // "missing"')
+
+    # "missing" means the app has never run in this repo — no orphaned suite possible
+    [ "$setting" = "missing" ] && continue
+    [ "$setting" = "false"   ] && continue
+
+    local app_label="app_id=$app_id"
+    [ "$app_id" = "1236702" ] && app_label="Claude (1236702)"
+    [ "$app_id" = "347564"  ] && app_label="CodeRabbit (347564)"
+
+    add_finding "$repo" "settings" "check-suite-auto-trigger-${app_id}" "error" \
+      "$app_label auto-trigger is enabled: GitHub creates a queued check suite on every push that is never completed, permanently blocking auto-merge. Run: \`bash scripts/apply-repo-settings.sh $repo\`" \
+      "standards/github-settings.md"
+  done
+}
+
 # ---------------------------------------------------------------------------
 # Issue management
 # ---------------------------------------------------------------------------
@@ -1299,6 +1333,7 @@ main() {
     check_centralized_check_names "$repo"
     check_claude_md "$repo"
     check_agents_md "$repo"
+    check_check_suite_prefs "$repo"
     pp_run_all_checks "$repo"
 
     log_end