💡 Non-Required Check Circuit Breaker for Merge Pipeline Resilience

[github-actions[bot]]

Summary

When a non-required CI check fails persistently across all PRs, the PR review agent treats every PR as 'CI-failing' and skips review. This creates a silent merge deadlock where no PR can merge and no fleet alert fires. A circuit breaker pattern in ci-status.sh would detect sustained non-required check failures (N consecutive failures across M distinct PRs) and auto-degrade them from the CI-passing determination, while simultaneously firing a fleet alert so a human investigates the root cause.

Market Signal

Resilience engineering patterns (circuit breakers, bulkheads) from Hystrix/Resilience4j are well-established in service mesh and microservice architectures. GitHub's new 'Workflow execution protections' (GA Sep 17, 2026) show the platform itself moving toward fine-grained execution controls. The agentic SWE tooling space (Copilot, Cursor, Codex) ships review-to-fix loops that depend on CI status signals being accurate — a broken CI signal breaks the entire automated delivery chain.

User Signal

• Issue Non-required failing check silently deadlocks every merge: template-drift fails on all PRs, review agent skips as ci-failing, no approval can land #1795: 'Non-required failing check silently deadlocks every merge: template-drift fails on all PRs, review agent skips as ci-failing, no approval can land.'
• Issue template-drift fails on every PR since standards/v1-stable moved (2026-09-13 04:03Z) — repo-template carries Dependabot bumps standards/ lacks #1791: 'template-drift fails on every PR since standards/v1-stable moved (2026-09-13 04:03Z) — repo-template carries Dependabot bumps standards/ lacks.'
• These are this-week (2026-09-13) incidents where a non-required check failure deadlocked the entire merge pipeline.

Technical Opportunity

scripts/lib/ci-status.sh already gates on isRequired (the #1549 enhancement). The circuit breaker extends this: when a non-required check has failed on the last N PRs consecutively, automatically exclude it from the CI-status determination and emit a ::warning:: + fleet alert. The existing fleet monitor infrastructure (actions-fleet-monitor.yml) handles alert routing. Implementation is additive — a new circuit_breaker_check() function in ci-status.sh that the existing gate calls.

Assessment

Dimension	Score	Rationale
Feasibility	high	Pure bash/jq addition to an existing library; reuses fleet-alert infra
Impact	high	Prevents a class of silent merge deadlock that affects the entire org
Urgency	high	The exact scenario happened this week (#1795/#1791)

Adversarial Review

Strongest objection: A circuit breaker that auto-excludes a failing check could mask a legitimate CI regression — a real problem hiding behind a broken check would ship uncaught.

Rebuttal: The circuit breaker NEVER silently ignores — it simultaneously fires a fleet alert issue (using the existing fleet-alert infrastructure). The trade-off is explicit: unblock merging AND loudly escalate to a human, rather than silently blocking everything. The threshold (N=3 consecutive failures across M=2 distinct PRs) ensures one-off flakes don't trigger. The merge deadlock (#1795) is strictly worse than an investigated, alerted, time-bounded degradation.

Suggested Next Step

Add a circuit_breaker_check() function to scripts/lib/ci-status.sh that tracks consecutive non-required failures and returns a degraded status when tripped. Add a BATS test covering the deadlock scenario from #1795. File as a standalone issue — the implementation is <100 lines of bash and reuses existing fleet-alert infrastructure.