fix(ci): make the dependabot auto-merge guard refuse instead of merging - #90
Merged
Conversation
The "Wait for CI checks to pass" step printed a refusal and then `exit 0`, which makes the STEP SUCCEED. The merge steps below it gate only on `steps.metadata.outputs.update-type` -- never on this step's outcome. A step whose `if:` contains no status function carries an implicit `success()`, so a later step is skipped only when an earlier one FAILS. A guard that exits zero therefore announced "skipping auto-merge" and then ran `gh pr merge --squash`. Nothing has merged wrongly, and the reason is worth stating precisely rather than as a near-miss: `main` is protected with required contexts, which refuses the merge independently. The defect is that this guard contributed no defence-in-depth while its own message asserted otherwise -- a check reporting a verdict it never enforced. Branch protection also only enforces checks it knows about, so a required check that silently never reports is invisible to it. harmonia and the canonical reusable in forkwright/.github both already carry this fix with a comment naming the same failure mode; this copy predates them. Refs #89
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The "Wait for CI checks to pass" step printed a refusal and then
exit 0,which makes the STEP SUCCEED.
The merge steps below it gate only on
steps.metadata.outputs.update-type-- never on this step's outcome. A step whose
if:contains no statusfunction carries an implicit
success(), so a later step is skipped onlywhen an earlier one FAILS. A guard that exits zero therefore announced
"skipping auto-merge" and then ran
gh pr merge --squash.Nothing has merged wrongly, and the reason is worth stating precisely
rather than as a near-miss:
mainis protected with required contexts,which refuses the merge independently. The defect is that this guard
contributed no defence-in-depth while its own message asserted otherwise
-- a check reporting a verdict it never enforced. Branch protection also
only enforces checks it knows about, so a required check that silently
never reports is invisible to it.
harmonia and the canonical reusable in forkwright/.github both already
carry this fix with a comment naming the same failure mode; this copy
predates them.
Refs #89