feat(broker): grant PUT /repos/*/pulls/*/merge — PO decision - #2224
Merged
Conversation
Closes #2203. This does not widen what the credential can do; it makes an existing capability honest. PATCH /repos/*/git/refs/* has been granted since v1.6.0, and it can fast-forward a base branch to a PR head — which GitHub records as a merged pull request. So merge was always reachable through the broker. The catalogue simply did not say so, and #2203 was filed on exactly that gap after I found it while landing commits through the brokered path. A rule the allow-list forbids but a one-line call achieves is worse than an explicit grant, because it makes the list unreliable as a statement of what a credential can do. Someone reading it would conclude hydra cannot merge, and be wrong. Naming the capability keeps merge authority reviewable, greppable and revocable in one place instead of being an emergent property of the refs rule.⚠️ The consequence is real and should be scoped accordingly: whoever holds a github credential brokered through this catalogue can now merge pull requests, explicitly. That is the decision, not a side effect of it. The guard test in DoffinProviderTest caught this immediately (14 -> 15), which is what it is for. Updated with the reasoning rather than just the number, so the next reader sees why the count moved. Unblocks hydra#425 task 2.3: the applier's GO verdict can now become a merge. Gates: 15,539 unit tests green.
Contributor
Quality Report — ConductionNL/openregister @
|
| Check | PHP | Vue | Security | License | Tests |
|---|---|---|---|---|---|
| lint | ✅ | ||||
| phpcs | ❌ | ||||
| phpmd | ✅ | ||||
| psalm | ✅ | ||||
| phpstan | ✅ | ||||
| phpmetrics | ✅ | ||||
| eslint | ✅ | ||||
| stylelint | ✅ | ||||
| composer | ✅ | ✅ 174/174 | |||
| npm | ✅ | ✅ 555/555 | |||
| PHPUnit | ⏭️ | ||||
| Newman | ⏭️ | ||||
| Playwright | ⏭️ |
Quality workflow — 2026-07-31 08:11 UTC
Download the full PDF report from the workflow artifacts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2203.
This does not widen what the credential can do. It makes an existing capability honest.
PATCH /repos/*/git/refs/*has been granted since v1.6.0, and it can fast-forward a base branch to a PR head — which GitHub records as a merged pull request. So merge was always reachable through the broker. The catalogue simply did not say so, and #2203 was filed on exactly that gap after I found it while landing commits through the brokered path.A rule the allow-list forbids but a one-line call achieves is worse than an explicit grant: it makes the list unreliable as a statement of what a credential can do. Someone reading it would conclude hydra cannot merge, and be wrong.
Naming the capability keeps merge authority reviewable, greppable and revocable in one place, instead of being an emergent property of the refs rule.
Whoever holds a
githubcredential brokered through this catalogue can now merge pull requests, explicitly. That is the decision, not a side effect of it — scope the credential accordingly.The guard test earned its keep
DoffinProviderTestfailed immediately on 14 → 15, which is exactly what it exists for. Updated with the reasoning rather than just the number, so the next reader sees why the count moved.Gates
15,539 unit tests green.
Unblocks hydra#425 task 2.3 — the applier's GO verdict can now become a merge.