Add a guard job to prevent accidental auto-merging of PRs when cross-version tests fail

.github/workflows/auto-merge.js

@@ -0,0 +1,114 @@
+module.exports = async ({ github, context }) => {
+  const {
+    repo: { owner, repo },
+  } = context;
+
+  const MERGE_INTERVAL_MS = 5000; // 5 seconds pause after a merge
+  const MAX_RETRIES = 3;
+  const RETRY_INTERVAL_MS = 10000; // 10 seconds
+
+  async function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+
+  async function logRateLimit() {
+    const { data: rateLimit } = await github.rest.rateLimit.get();
+    console.log(`Rate limit remaining: ${rateLimit.resources.core.remaining}`);
+    console.log(
+      `Rate limit resets at: ${new Date(rateLimit.resources.core.reset * 1000).toISOString()}`
+    );
+  }
+
+  async function fetchPullRequestDetails(prNumber) {
+    for (let i = 0; i < MAX_RETRIES; i++) {
+      const pullRequest = await github.rest.pulls
+        .get({
+          owner,
+          repo,
+          pull_number: prNumber,
+        })
+        .then((res) => res.data);
+
+      if (pullRequest.mergeable !== null) {
+        return pullRequest;
+      }
+
+      console.log(`Waiting for mergeability calculation for PR #${prNumber}...`);
+      await sleep(RETRY_INTERVAL_MS);
+    }
+    return null;
+  }
+
+  async function isPRApproved(prNumber) {
+    const { data: reviews } = await github.rest.pulls.listReviews({
+      owner,
+      repo,
+      pull_number: prNumber,
+    });
+    return reviews.some((review) => review.state === "APPROVED");
+  }
+
+  async function areAllChecksPassed(sha) {
+    const { data: checkRuns } = await github.rest.checks.listForRef({
+      owner,
+      repo,
+      ref: sha,
+    });
+    return checkRuns.check_runs.every(({ conclusion }) =>
+      ["success", "skipped"].includes(conclusion)
+    );
+  }
+
+  // Get date from a month ago in ISO format
+  const oneMonthAgo = new Date();
+  oneMonthAgo.setMonth(oneMonthAgo.getMonth() - 1);
+  const sinceDate = oneMonthAgo.toISOString();
+
+  // List PRs with the "automerge" label created within the last month
+  const { data: issues } = await github.rest.issues.listForRepo({
+    owner,
+    repo,
+    labels: "automerge",
+    since: sinceDate,
+  });
+
+  // Filter for pull requests from the list of issues
+  const pullRequests = issues.filter((issue) => issue.pull_request);
+
+  for (const pr of pullRequests) {
+    const pullRequest = await fetchPullRequestDetails(pr.number);
+
+    if (!pullRequest?.mergeable) {
+      console.log(
+        `PR #${pr.number} is not mergeable or could not fetch details. Skipping this PR.`
+      );
+      await logRateLimit();
+      continue;
+    }
+
+    if (!(await isPRApproved(pr.number))) {
+      console.log(`PR #${pr.number} hasn't been approved. Skipping merge.`);
+      await logRateLimit();
+      continue;
+    }
+
+    if (await areAllChecksPassed(pullRequest.head.sha)) {
+      try {
+        await github.rest.pulls.merge({
+          owner,
+          repo,
+          pull_number: pr.number,
+        });
+        console.log(`Merged PR #${pr.number}`);
+
+        await sleep(MERGE_INTERVAL_MS);
+        await logRateLimit();
+      } catch (error) {
+        console.log(`Failed to merge PR #${pr.number}. Reason: ${error.message}`);
+      }
+    } else {
+      console.log(`Checks not ready for PR #${pr.number}. Skipping merge.`);
+      await logRateLimit();
+    }
+  }
+};

.github/workflows/auto-merge.yml

@@ -0,0 +1,20 @@
+name: Automerge
+
+on:
+  schedule:
+    - cron: "*/10 * * * *" # Run every 10 minutes
+
+jobs:
+  merge:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Automerge
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          retries: 3
+          script: |
+            const script = require('./.github/workflows/auto-merge.js');
+            await script({github, context});

.github/workflows/remove-automerge-label.yml

@@ -0,0 +1,33 @@
+name: Remove automerge label
+
+on:
+  pull_request_target:
+    types:
+      - synchronize
+
+jobs:
+  remove-label:
+    runs-on: ubuntu-latest
+    if: ${{ !contains(fromJSON('["OWNER", "COLLABORATOR", "MEMBER"]'), github.event.pull_request.author_association )}}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Remove automerge label
+        uses: actions/github-script@v5
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const { owner, repo, number: issue_number } = context.issue;
+            const labelToRemove = "automerge";
+
+            // Fetch current labels on the PR
+            const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({ owner, repo, issue_number });
+
+            // Check if the label is present
+            const hasLabel = currentLabels.some(label => label.name === labelToRemove);
+
+            if (hasLabel) {
+              await github.rest.issues.removeLabel({ owner, repo, issue_number, name: labelToRemove });
+              console.log(`Removed label "${labelToRemove}" from PR #${issue_number}`);
+            } else {
+              console.log(`Label "${labelToRemove}" not found on PR #${issue_number}`);
+            }