2bcd52b444
Gitea is case-sensitive on owner slugs; canonical is lowercase `molecule-ai/...`. Mixed-case `Molecule-AI/...` refs fail-at-0s when the runner tries to resolve the cross-repo workflow / checkout. Same fix as molecule-controlplane#12. Mechanical case-correction; no behavior change beyond making CI resolve again. Refs: internal#46 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
54 lines
2.1 KiB
YAML
54 lines
2.1 KiB
YAML
name: Disable auto-merge on push
|
|
|
|
# Reusable guard against the "I enabled auto-merge then pushed more
|
|
# commits" race. Background: on 2026-04-27, PR #2174 in molecule-core
|
|
# auto-merged with only the first commit because the second commit
|
|
# was pushed AFTER the merge queue had already locked the PR's SHA.
|
|
# The second commit ended up orphaned on a merged-and-deleted branch.
|
|
#
|
|
# Mechanism: on every `pull_request: synchronize` event (= new commit
|
|
# pushed to an open PR), check if auto-merge is enabled. If yes,
|
|
# disable it and post a comment. This forces the operator to
|
|
# re-engage `gh pr merge --auto` after the new push, with the
|
|
# re-engagement acting as the verification step.
|
|
#
|
|
# Call from each repo's .github/workflows/ via a thin wrapper:
|
|
#
|
|
# name: pr-guards
|
|
# on:
|
|
# pull_request:
|
|
# types: [synchronize]
|
|
# permissions:
|
|
# pull-requests: write
|
|
# jobs:
|
|
# disable-auto-merge-on-push:
|
|
# uses: molecule-ai/molecule-ci/.github/workflows/disable-auto-merge-on-push.yml@v1
|
|
#
|
|
# False-positive behavior: if a CI bot pushes (e.g. dependency-update
|
|
# rebase, secret rotation), this also disables auto-merge for that
|
|
# PR. That's acceptable — the operator who originally enabled
|
|
# auto-merge gets notified and re-engages, which is exactly the
|
|
# verify-after-machine-edits behavior we want.
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
guard:
|
|
name: Disable auto-merge on push
|
|
runs-on: ubuntu-latest
|
|
if: github.event.pull_request.auto_merge != null
|
|
permissions:
|
|
pull-requests: write
|
|
steps:
|
|
- name: Disable auto-merge
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
PR: ${{ github.event.pull_request.number }}
|
|
REPO: ${{ github.repository }}
|
|
NEW_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
set -eu
|
|
gh pr merge "$PR" --disable-auto -R "$REPO" || true
|
|
gh pr comment "$PR" -R "$REPO" --body "🔒 Auto-merge disabled — new commit (\`${NEW_SHA:0:7}\`) pushed after auto-merge was enabled. The merge queue locks SHAs at entry, so subsequent pushes can race. Verify the new commit and re-enable with \`gh pr merge --auto\`."
|