Skip to content

merge queue: checking #12694 on main (a49aada), stacked on #12695 and #12687 - #12708

Closed
mergify[bot] wants to merge 6 commits into
mainfrom
mergify/merge-queue/bbacb7dd5f
Closed

merge queue: checking #12694 on main (a49aada), stacked on #12695 and #12687#12708
mergify[bot] wants to merge 6 commits into
mainfrom
mergify/merge-queue/bbacb7dd5f

Conversation

@mergify

@mergify mergify Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

🎉 This pull request has been checked successfully and will be merged soon. 🎉

#12694 is queued for merge on branch main (a49aada).

Stacked behind 2 pull requests queued ahead of this batch, not part of it. These checks run on a tip that also carries their commits, so a failure here can come from them as much as from #12694.

Queued ahead of this batch:

This pull request has been created by Mergify to speculatively check the mergeability of #12694.
You don't need to do anything. Mergify will close this pull request automatically when it is complete.

Required conditions of queue rule default for merge:

Required conditions to stay in the queue:

---
checking_base_sha: af3d907e67f05631a4b391c26736ba496a088fe5
previous_check_retries: []
previous_failed_batches: []
pull_requests:
  - number: 12694
    scopes: []
scopes: []
...

sileht and others added 6 commits September 4, 2026 17:35
The CLI docs told everyone to hand it a GitHub token: `GITHUB_TOKEN`, or
whatever `gh auth token` returns. That credential is now the deprecated
path for the Mergify API, so every page that led with it was steering new
users onto it.

`mergify auth login` signs in through an OAuth 2.0 device grant and stores
a Mergify-issued user token in the OS credential store. Document it as the
way in, and mark `GITHUB_TOKEN` and the `gh auth token` fallback deprecated
where they back a Mergify API call.

Two things the rewrite is careful not to say. CI does not run an
interactive sign-in, so the application-key guidance stays exactly as it
was, and the `ci` commands still need a `ci` key that a user token will
not replace. And Stacks is a pure GitHub API client: it never calls
api.mergify.com, so a GitHub token is what it needs, `mergify auth login`
does nothing for it, and nothing about it is deprecated. Both pages that
cover Stacks now say so outright, since the old wording ("point
MERGIFY_TOKEN or GITHUB_TOKEN at a GitHub token") invited exactly the
mix-up the page below it warns about. Stacks still reads MERGIFY_TOKEN
first, and a dozen other pages tell readers to put an application key
there, so the setup page keeps that warning rather than dropping it with
the sentence that used to carry it.

cli/agents.mdx is in scope for the same reason as the other two: its
Authentication section opened by recommending a GitHub token, which after
this change would be the docs' loudest pointer at the deprecated path. So
is the `/cli` landing page, which sold the CLI on reusing your `gh` login.

api/usage.mdx loses half a sentence: a PAT is still a fine way to call the
API directly, but it is no longer a reason to reach for the CLI.

Details worth stating exactly, because each one was wrong in a first
draft and checked against the shipped engine and dashboard: the approval
page is a form you type the code into, not one that shows you a code, and
it asks for a token name; the 20-token ceiling is refused in the browser,
so a login that never completes is explained there and not in the
terminal; credentials are keyed by API URL, so an on-premise sign-in only
holds for commands that resolve the same URL; and `mergify config
validate` needs no credential at all, since it fetches the public schema
and checks the file locally.

No changelog entry. Deprecation is not the announcement, removal will be.

Fixes MRGFY-8704

Change-Id: Iab17a20075d1e8a8905a1fc0b04bd3b578c001b0
The install screenshot on the Browser Extensions page framed a dashboard
sidebar that no longer exists: top-level Integrations, Config Editor,
Commands Restrictions and Event Logs entries. Those moved into the Settings
sidebar — Integrations under Developer, Config Editor and Commands
Restrictions under Configuration — so the image contradicted the step above
it, which already tells you to open Settings → Integrations and pick the
Browser category.

Only the image was stale, so this is a reshoot with no text change. The alt
text already described the Browser category and the two cards, and it still
does.

The replacement frames the content pane only — the category rail with Browser
selected, plus the Chrome Extension and Firefox Add-On cards — instead of the
whole viewport. That follows the capture conventions, which say to crop the
sidebar out unless the navigation is the point, for exactly the reason this
image rotted: a shot built around the sidebar goes stale every time a nav item
moves, even when the feature it documents has not changed. It also drops the
org name, the signed-in user's name and their avatar that the old shot carried.

Captured headless at 1440x900, retina 2x, light theme, from the mergify-sandbox
org.

Fixes Mergifyio/ci-bot#389
MRGFY-8060

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FREXr8FPsik88qcghADHcE
Change-Id: If8367fb480011d7bb31b92025a5e68d2c599f648
The Detection, Mitigation and Prevention images were captured against a
dashboard logged into an org with access to our private repositories, and they
have been served on docs.mergify.com ever since: real internal test paths, a
real pull request with its author, number and title, and a private repository
name in the selector. These three replace them with captures of
`mergify-sandbox`, an org that holds nothing private, so the same pages teach
the same thing without publishing anything.

The alternative was removing them and leaving the pages imageless, which is
what I first proposed. Replacing is better: the pages are about reading a
dashboard, and describing a donut in prose is not the same as showing one.

## What each shot shows, and that it is real

Nothing here is mocked or posed. The sandbox repository runs a real pytest
suite on a schedule through pytest-mergify, with two intentionally flaky tests,
and Test Insights has been watching it for a month.

- **Detection** — the tests-health donut (93.33% healthy, 6.67% flaky) and the
  CI Impact chart over its 141 failed executions.
- **Mitigation** — quarantine scale and impact (2 tests saved 69 times), and the
  quarantined-tests list carrying both sources, auto and manual.
- **Prevention** — caught-flaky, new-tests and CI-budget metrics, and the
  new-tests list broken down per pull request with each test's health.

Two framing decisions worth stating. All three are cropped to the content pane
rather than the whole window: a screenshot with the sidebar in frame goes stale
every time a nav item is renamed, even when the documented feature has not
moved, and that is how most of our screenshots rotted. Mitigation and
Prevention are shot over a one-month window rather than the default week,
because the week's numbers are zeros and an empty panel teaches nothing.

## What this does not do

The git history keeps the old blobs, and I would not spend a history rewrite on
them. What leaked is internal test paths, one pull request title and a private
repository name — no credentials, nothing that grants access, no customer data.
A rewrite means force-pushing main and invalidating every open pull request and
clone, and it still would not delete anything: the blobs stay reachable by SHA
until GitHub garbage-collects, forks keep their copies, and the built pages have
been crawled. What is worth doing instead is purging the CDN cache for the three
asset URLs once this lands.

MRGFY-8780
Fixes Mergifyio/ci-bot#373

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012x4fo5P6sFzCsKGZ8DDxLE
Change-Id: I98c28b4ca873d58a85b60c4df5e620145c2c10f1
@mergify
mergify Bot deployed to Mergify Merge Protections September 7, 2026 08:29 Active
@mergify mergify Bot closed this Sep 7, 2026
@mergify
mergify Bot deleted the mergify/merge-queue/bbacb7dd5f branch September 7, 2026 08:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants