From 1b49b149d0365c5601a41858785d5fc5f80ce1a4 Mon Sep 17 00:00:00 2001 From: Satoshi Qazi Muhammed Date: Sat, 11 Jul 2026 08:12:47 -0700 Subject: [PATCH] fix: auto-merge only waited on Code Quality, never retried after Security auto-merge.yml only listened for the "Code Quality" workflow_run event. Whenever "Security" (CodeQL etc., usually the slower of the two) finished after Code Quality, the merge attempt fired too early, failed against the still-pending required check, and nothing ever re-triggered it - the PR sat open until someone noticed and merged it by hand. This is the actual cause behind the recurring "master->main sync PR stuck" issue, not a one-off fluke. Now listens for both workflows, and verifies every required check is actually green (via `gh pr checks --required`) before merging rather than trusting that the one workflow which fired us means everything is done - whichever of the two finishes last will now successfully trigger the merge. --- .github/workflows/auto-merge.yml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index f34b819..43ea815 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -2,7 +2,12 @@ name: Auto Merge on: workflow_run: - workflows: ["Code Quality"] + # Both required workflows must be listed - this used to list only "Code Quality", so whenever "Security" + # (which includes CodeQL, usually the slower one) finished AFTER Code Quality, nothing ever re-triggered + # the merge attempt and the PR sat open until someone noticed and merged it manually. Listing both means + # whichever finishes LAST fires this workflow, and the check-verification step below (not just "trust the + # one workflow that happened to trigger us") confirms every required check is actually green before merging. + workflows: ["Code Quality", "Security"] types: [completed] jobs: @@ -41,6 +46,15 @@ jobs: exit 0 fi + # Don't trust that the workflow which triggered us means every required check is done - the other + # workflow (Code Quality vs Security) might still be running. Verify every required check is + # actually green before attempting to merge; if not, exit quietly and let whichever check finishes + # last re-trigger this workflow. + if ! gh pr checks "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --required --watch=false; then + echo "Not all required checks are green yet for PR #$PR_NUMBER - skipping, will retry when the remaining workflow completes" + exit 0 + fi + echo "Merging PR #$PR_NUMBER" gh pr merge "$PR_NUMBER" \ --repo "$GITHUB_REPOSITORY" \