2 changed files with 30 additions and 1 deletions
@@ -407,7 +407,30 @@ def process_once(*, dry_run: bool = False) -> int:
                "deferring to next tick"
            )
            return 0
-        merge_pull(pr_number, dry_run=dry_run)
+        try:
+            merge_pull(pr_number, dry_run=dry_run)
+        except ApiError as exc:
+            # Merge failed (pre-receive hook, branch protection, etc.).
+            # Remove queue label so next tick picks the next PR.
+            msg = str(exc)
+            if "405" in msg or "not allowed to merge" in msg.lower():
+                hint = "pre-receive hook or branch protection blocked the merge"
+            elif "422" in msg or "Unprocessable" in msg:
+                hint = "branch protection required-status check failed"
+            elif "409" in msg or "conflict" in msg.lower():
+                hint = "merge conflict"
+            else:
+                hint = msg[:200]
+            remove_label(pr_number, QUEUE_LABEL, dry_run=dry_run)
+            post_comment(
+                pr_number,
+                (
+                    f"merge-queue: merge blocked ({hint}). "
+                    f"Label removed — re-add once the block is resolved."
+                ),
+                dry_run=dry_run,
+            )
+            return 0
        return 0
    return 0

@@ -48,6 +48,12 @@ jobs:
          REQUIRED_CONTEXTS: >-
            CI / all-required (pull_request),
            sop-checklist / all-items-acked (pull_request)
+          # NOTE: qa-review / security-review gates intentionally omitted.
+          # These gates permanently fail (mc#1111: SOP_TIER_CHECK_TOKEN missing
+          # PAT — token owner not in qa/security teams). Adding them to
+          # REQUIRED_CONTEXTS would strip the merge-queue label from every PR
+          # in the queue, breaking the queue for all contributors.
+          # Re-add these gates once mc#1111 is resolved.
          # Push-side required contexts. Checking CI / all-required (push)
          # explicitly instead of the combined state avoids false-pause when
          # non-blocking jobs (continue-on-error: true) have failed — those