Skip to content

merge queue: checking main (9b73d0e) and #12454 together - #12469

Closed
mergify[bot] wants to merge 2 commits into
mainfrom
mergify/merge-queue/4296df893f
Closed

merge queue: checking main (9b73d0e) and #12454 together#12469
mergify[bot] wants to merge 2 commits into
mainfrom
mergify/merge-queue/4296df893f

Conversation

@mergify

@mergify mergify Bot commented Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🎉 This pull request has been checked successfully and will be merged soon. 🎉

Branch main (9b73d0e) and #12454 are queued together for merge.

This pull request has been created by Mergify to check the mergeability of #12454.
You don't need to do anything. Mergify will close this pull request automatically when it is complete.

Required conditions of queue rule default for merge:

Required conditions to stay in the queue:

---
checking_base_sha: 9b73d0e37d9374625cc610d8550783ee5e6ed969
previous_check_retries: []
previous_failed_batches: []
pull_requests:
  - number: 12454
    scopes: []
scopes: []
...

jd and others added 2 commits August 20, 2026 14:03
@jd
fix(safety): catch bare tracker ticket refs in the internal-leak scan
dd28773 
`pnpm check:internal-leaks` only ever saw a ticket as a *link*: its
`internal-tracker` rule matches tracker hosts. A bare issue key in prose, in a
code block or in an example value passed cleanly — and one did. The
`mergify tests quarantines add` example on the quarantine page shipped with a
`--reason` string naming an internal ticket, so it has been live on
docs.mergify.com since #11681 and sits in this repository's public history. The
scan reported that exact file clean, before and after.

A bare key is also the case a reviewer is least likely to stop on: inside an
example value it reads as a plausible sample rather than as a leak.

What changed:

- A `ticket-ref` rule for bare issue keys — the two live prefixes, plus the
  lowercase form a branch name carries.
- Prefixes are listed explicitly instead of matching a generic `[A-Z]{3,}-\d+`.
  The generic shape fires on `AES-256`, `WCAG-2` and on a reader's own issue keys
  in a sample config, and that cost lands on every docs contributor; the miss
  cost of an explicit list falls only on a prefix somebody introduces
  deliberately, which is a deliberate act.
- The allow directive now accepts several rule ids. One line can trip two rules
  — a tracker URL carries the key inside it — and such a line previously could
  not be allowed at all.
- The corpus is swept: across the 143 scanned pages that example was the only
  occurrence. Its reason string is now "flaky under load, fix in progress", the
  same wording #12411 uses for the same line, so the two changes do not fight.
  That also removes the prose em dash the example carried inside a CLI string.
- `AGENTS.md` and the `proofread-leaks` skill now list bare keys as well. The
  judgment layer had the same blind spot as the regex, which is why the line
  survived review too.

Verified: the scan exits 1 against the pre-fix file and 0 against the tree,
the full `pnpm test` suite and `pnpm check` are green, and the commit is green
on its own as well as on top of the stack.

One decision is deliberately left open: whether the already-published value
needs scrubbing beyond this branch. It is a ticket prefix rather than a
credential, and it is in the git history of a public repository as well as on
the site, so removing it from the page is all this change claims to do.

Reported as Mergifyio/ci-bot#368.

MRGFY-8721

Change-Id: I847b80676f560fb73f319e2524be6d94207591e8
@mergify
Merge of #12454
8b08e1d
@mergify
mergify Bot deployed to Mergify Merge Protections August 20, 2026 13:54 Active
@mergify mergify Bot mentioned this pull request Aug 20, 2026
Merged
@mergify mergify Bot closed this Aug 20, 2026
@mergify
mergify Bot deleted the mergify/merge-queue/4296df893f branch August 20, 2026 13:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jd