ci: auto-merge compatibility matrix PRs once CI is green - #1217
ci: auto-merge compatibility matrix PRs once CI is green#1217petercrocker wants to merge 2 commits into
Conversation
The compatibility matrix PR is generated by the Infrahub release pipeline and contains nothing but regenerated docs, so it should not need a human to click merge. Add a `ci-gate` rollup job that reports a single pass/fail for the whole CI workflow. Several CI jobs are conditional and `unit-tests` fans out over a moving Python matrix, so requiring individual checks in branch protection would be brittle; one rollup check is stable. Add a workflow that enables auto-merge on the bot's PR. It authenticates as opsmill-bot because auto-merge merges as whoever enabled it, and that is the identity allowed to bypass the approval requirement on stable. Waiting for CI is enforced by making `ci-gate` a required status check on stable, which is a repository setting applied separately.
petercrocker
added
group/ci
Deploying infrahub-sdk-python with
|
| Latest commit: |
69c8a31
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://dbeec316.infrahub-sdk-python.pages.dev |
| Branch Preview URL: | https://auto-merge-compat-matrix.infrahub-sdk-python.pages.dev |
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## stable #1217 +/- ##
=======================================
Coverage 82.47% 82.47%
=======================================
Files 138 138
Lines 12186 12186
Branches 1833 1833
=======================================
Hits 10051 10051
Misses 1572 1572
Partials 563 563
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 2 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
`types:` is an allowlist, so a draft-to-ready transition emitted only `ready_for_review` and nothing re-evaluated the job. The `draft == false` guard never got a second chance, and the bot pushes its branch once per release, so there was no guaranteed `synchronize` to recover. The guard itself stays: GitHub refuses to enable auto-merge on a draft, so the step would fail rather than skip without it.
| # approval requirement on `stable`, and auto-merge merges as whoever enabled it. | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GH_UPDATE_PACKAGE_OTTO }} | ||
| run: gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}" |
There was a problem hiding this comment.
This is a bit tricky. Because we don't have required CI checks, basically a PR is eligible to be merged the moment it is opened. Therefore the --auto flag would merge it instantly.
How we've overcome this is by using custom checks in the infrahub-github-bot https://github.com/opsmill/infrahub-github-bot/blob/main/core/pr_helper.py#L46, for the sync between develop<>stable
However, the release pipeline can't have a failing CI that will be raised during this phase, so in short term we could even do that although it's not 100% correct. @fatih-acar wdyt?
There was a problem hiding this comment.
I think it's safe for such documentation changes
Anyway I was reluctant to get that PR in (I'd like us to move forward with infrahub-github-bot to remove the repository dispatch automations we have...) but since it's already there... lgtm to merge but keep in mind we'll remove this change asap
3 participants
Why
The Infrahub release pipeline opens a
docs: update compatibility matrixPR intostableon every release (most recently #1216). It contains nothing but a regenerated compatibility table, yet it sits waiting for someone to click merge.Goal: those PRs merge themselves once CI is green.
Non-goals: this does not change how the PR is created — that workflow lives in
opsmill/infrahub(.github/workflows/update-sdk-compatibility-docs.yml) and is untouched. No other PR is auto-merged.What changed
ci-gate, alongside the existing per-job checks.Implementation notes:
ci-gate(.github/workflows/ci.yml)needs:every CI job, runs withif: always(), and fails only when a dependency reportedfailureorcancelled. Skipped jobs pass. This exists so branch protection can require CI with one context name: several jobs are conditional onfiles-changed(yaml-lint,action-lintanduv-lock-checkwere all skipped on docs: update compatibility matrix #1216), andunit-testsfans out over a Python matrix whose check names change whenever we add or drop a version.auto-merge-compatibility-docs.ymlguards on all of: same-repo head, head refautomated/update-compatibility-docs, basestable, authoropsmill-bot, and not a draft. It authenticates withGH_UPDATE_PACKAGE_OTTOrather thanGITHUB_TOKENbecause auto-merge merges as whoever enabled it, andopsmill-botis the identity onstable's review-bypass list.What stayed the same: no existing CI job was modified, and no other PR's merge behaviour changes until the branch-protection step below is applied.
Required follow-up — this PR does nothing on its own
stablecurrently has no required status checks. Without one,gh pr merge --autofinds no unmet requirement and merges immediately, ignoring CI. Making auto-merge actually wait requires registeringci-gateas a required check:That payload reproduces every current setting verbatim and adds only
required_status_checks. Three things to get right:ci-gateresult, which only happens once the job exists on the base branch.developneedsci-gatetoo. A PR's checks come from the head branch's workflow files, so adevelop → stablerelease PR would rundevelop'sci.yml. If that lacksci-gate, the release PR blocks forever. Port this change todevelop(or mergestableinto it) before enabling the required check.strict: falseis deliberate. Withstrict: truethe bot PR stalls wheneverstablemoves ahead, because auto-merge does not update the branch for you.How to review
Focus on the
ci-gateneeds:list — it must name every job inci.yml, or a failure in an omitted job would not block the gate. Current list:prepare-environment,files-changed,yaml-lint,python-lint,markdown-lint,action-lint,uv-lock-check,documentation,validate-generated-documentation,validate-documentation-style,unit-tests,integration-tests-latest-infrahub.Worth extra scrutiny: these PRs will merge without the
sateam review the creating workflow requests.opsmill-botbypasses the approval requirement onstable, so green CI is the only gate. That was a deliberate call for a docs-only change; say so if you'd rather keep a human in the loop, in which case the fix is to dropopsmill-botfrom the bypass list.How to test
Both pass locally. End to end, the next release-triggered compatibility PR should show an
enable-auto-mergerun and an "auto-merge enabled" banner, then merge on its own whenci-gategoes green.Impact & rollout
ci-gateis made a required check. The auto-merge workflow is inert for every PR that does not match all five guards.GH_UPDATE_PACKAGE_OTTOsecret; adds no new secret. Adds one short-lived runner job per CI run.stable— nothing enforces that today.Summary by cubic
Auto-merges the generated compatibility matrix PRs once CI is green by adding a
ci-gaterollup check and a targeted auto-merge workflow. Other PRs are unchanged.New Features
ci-gatejob that depends on all CI jobs and fails only onfailure/cancelled(skips pass), giving one stable check for branch protection..github/workflows/auto-merge-compatibility-docs.ymlto enable squash auto-merge for the docs PR only (same-repo, headautomated/update-compatibility-docs, basestable, authoropsmill-bot, not draft) usingGH_UPDATE_PACKAGE_OTTO; re-evaluates onready_for_reviewto handle draft-to-ready transitions.Migration
ci-gateas a required status check onstable(and ensuredevelopalso includesci-gatebefore release PRs); keep strict=false.Written for commit 69c8a31. Summary will update on new commits.