Skip to content

docs(auto-merge-guide): expand Copilot auto-approve race-condition guide#59

Merged
CybotTM merged 3 commits into
mainfrom
docs/auto-approve-copilot-race
Apr 22, 2026
Merged

docs(auto-merge-guide): expand Copilot auto-approve race-condition guide#59
CybotTM merged 3 commits into
mainfrom
docs/auto-approve-copilot-race

Conversation

@CybotTM
Copy link
Copy Markdown
Member

@CybotTM CybotTM commented Apr 21, 2026

Summary

Expands the existing Auto-Approve Race Condition with Copilot Reviewer section in references/auto-merge-guide.md so it covers the full diagnose-fix-prevent cycle instead of just the re-run workaround. Marks it as the canonical home for this gotcha so project-level CLAUDE.md entries can link here instead of duplicating the details.

Why

A concrete session hit this on netresearch/t3x-nr-vault#116:

  • All 43 CI status checks SUCCESS
  • pr-quality / Auto-Approve (Solo Maintainer) job reported success
  • github-actions[bot] had approved the PR (from a previous push)
  • No unresolved review threads, no CHANGES_REQUESTED
  • Still mergeStateStatus: BLOCKED, reviewDecision: "" (empty string — not REVIEW_REQUIRED)

The skill covered the re-run fix but didn't mention:

  1. The empty-reviewDecision symptom variant (distinct from REVIEW_REQUIRED)
  2. How to diagnose the silent-skip from job logs
  3. Prevention patterns (workflow-config fixes, not just remediation)

So the user's project-level CLAUDE.md carried the full write-up (Auto-Approve Race Condition with Copilot Reviewer) — per the learned-rule "Skills are team memory", that content belongs here.

Changes

  • references/auto-merge-guide.md — expand the race-condition section:
    • Second symptom variant: reviewDecision: ""
    • Diagnosis block (extract job id, grep log for skip marker, check current requested_reviewers)
    • Prevention options A/B/C (pull_request_review trigger / poll-with-retry / gate on pull_request_review)
    • Anti-pattern warning against setting required_approving_review_count: 0
    • Cross-link to CI Re-runs Replay the Same Commit so people don't rerun the old failed run
    • Updated troubleshooting table row to cover both symptom variants
  • SKILL.md — surface "Copilot reviewer race conditions" in the frontmatter description and update the Merge Strategy Issues quick line to point at the canonical section
  • checkpoints.yaml — new GH-33 (severity warning): detects pr-quality.yml that lacks a pull_request_review trigger. No-ops when the workflow doesn't exist. Follows the existing GH-24..GH-27 pattern of command/regex checks against workflow files.

Test plan

  • yamllint skills/github-project/checkpoints.yaml clean
  • Markdown structure preserved — all cross-references resolve (#ci-re-runs-replay-the-same-commit, ../assets/pr-quality.yml.template, #auto-approve-race-condition-with-copilot-reviewer)
  • Commit signed (GPG) and Signed-off-by: matches author (sebastian.mendel@netresearch.de)
  • CI (actionlint, markdownlint, etc.) passes on push

The existing "Auto-Approve Race Condition with Copilot Reviewer"
section covered the re-run fix but omitted diagnosis, prevention,
and a second observed symptom (empty reviewDecision, not just
REVIEW_REQUIRED). A concrete session hit this on a PR where 43
checks were green, auto-approve reported success, and the PR still
showed mergeStateStatus=BLOCKED with reviewDecision="". Nothing in
the skill pointed at the workflow-config root cause.

Changes:

- auto-merge-guide.md: mark the section as the canonical home for
  this gotcha (project CLAUDE.md files should cross-reference it
  instead of restating). Add:
    - Second symptom: reviewDecision="" (empty string) observed
      when Copilot is mid-review and required_approving_review_count
      >= 1.
    - Diagnosis block: how to extract the auto-approve job id and
      grep its logs for the silent skip marker; how to query current
      requested_reviewers to confirm Copilot has cleared.
    - Expected post-fix state: mergeStateStatus=CLEAN,
      reviewDecision=APPROVED.
    - Why the rerun works, with cross-link to the existing "CI
      Re-runs Replay the Same Commit" section so people don't rerun
      the OLD failed run.
    - Prevention patterns A/B/C (pull_request_review trigger, poll
      with retry, pull_request_review-gated approval), plus an
      anti-pattern warning against setting
      required_approving_review_count to 0.
  Updated the troubleshooting-table row to cover both symptom
  variants and to link to the expanded section instead of "see below".

- SKILL.md: mention the Copilot green-CI race in the frontmatter
  description, and update the "Merge Strategy Issues" quick line to
  point at the canonical section.

- checkpoints.yaml: new mechanical check GH-33 that detects a
  pr-quality.yml without a pull_request_review trigger (warning).
  Follows the existing GH-24..GH-27 pattern of regex/command checks
  against workflow files; no-ops if the workflow doesn't exist.

Observed on netresearch/t3x-nr-vault PR #116 during an auto-merge
session — the failure mode matches the CLAUDE.md learned-rule
"Auto-Approve Race Condition with Copilot Reviewer", which will now
cross-reference this file instead of duplicating it.

Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
Signed-off-by: Sebastian Mendel <sebastian.mendel@netresearch.de>
Copilot AI review requested due to automatic review settings April 21, 2026 23:39
@gemini-code-assist
Copy link
Copy Markdown
Contributor

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 21, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Expands documentation and project guidance around a GitHub Copilot reviewer / auto-approve race condition, and adds a repository checkpoint to detect workflows likely to hit it.

Changes:

  • Expanded the “Auto-Approve Race Condition with Copilot Reviewer” section to include symptoms, diagnosis steps, remediation, and prevention options.
  • Updated SKILL.md metadata and quick guidance to reference the expanded canonical documentation.
  • Added checkpoint GH-33 to warn when pr-quality.yml lacks a pull_request_review trigger.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File Description
skills/github-project/references/auto-merge-guide.md Extends the race-condition guide (symptoms/diagnosis/fix/prevention) and updates the troubleshooting table.
skills/github-project/checkpoints.yaml Adds GH-33 checkpoint to detect missing review-trigger coverage in pr-quality.yml.
skills/github-project/SKILL.md Surfaces the race condition in the skill description and points to the canonical guide section.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread skills/github-project/references/auto-merge-guide.md Outdated
Comment thread skills/github-project/references/auto-merge-guide.md Outdated
Comment thread skills/github-project/references/auto-merge-guide.md Outdated
Comment thread skills/github-project/references/auto-merge-guide.md Outdated
Comment thread skills/github-project/checkpoints.yaml Outdated
CybotTM added 2 commits April 22, 2026 01:46
Skill Validation requires SKILL.md <= 500 words. After the previous
commit's additions (Copilot-review race diagnosis) the file grew to
530 words. Tighten:

- Description: drop 'Dependabot/Renovate' redundancy (already implied
  by 'auto-merge'), shorten parenthetical
- Merge Strategy Issues: replace the inline list with a single
  pointer at references/auto-merge-guide.md — the details live
  there anyway, and this removes ~30 words

Final: 492 words.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
- Scope RUN_ID lookup by PR head SHA in diagnosis and rerun snippets
  so the examples don't pick runs from unrelated PRs/branches.
- Pipe JOB_ID extraction to head -1 to guarantee a single id.
- Read job logs via 'gh run view --log' instead of 'gh api .../logs',
  which returns a zipped artifact that can't be grepped directly.
- Use POSIX-portable [[:space:]] instead of \s in the checkpoints.yaml
  grep, since ERE \s is a GNU extension.

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>
@CybotTM CybotTM merged commit 0bb3580 into main Apr 22, 2026
11 checks passed
@CybotTM CybotTM deleted the docs/auto-approve-copilot-race branch April 22, 2026 00:01
@CybotTM CybotTM mentioned this pull request May 15, 2026
CybotTM added a commit that referenced this pull request May 15, 2026
## Release v2.14.0

Minor release. `.claude-plugin/plugin.json` and
`skills/github-project/SKILL.md` frontmatter `metadata.version` were
already synced to `2.14.0` on `main` via
[#74](#74) —
this PR is the empty release marker that closes the v2.13.1 → v2.14.0
window and triggers the signed-tag release.

### Highlights since v2.13.1

- **`agentic-workflows` reference** documenting `gh-aw` and `awf`
workflow-as-prompt tooling for autonomous GitHub Actions — new patterns
for running AI agents on PRs/issues without bespoke wiring
([#75](#75)).
- **AI reviewer pushback patterns** — handling Copilot/Sourcery review
comments that disagree with the codebase intent, including when to defer
and when to push back
([#66](#66),
[#74](#74)).
- **PR-merge / branch-protection / CodeQL gotchas** documented, plus
auto-detection of allowed merge strategy in the `--delete-branch`
snippet so the recipe doesn't break on repos with merge-commit-only
policies
([#69](#69),
[#71](#71),
[#72](#72)).
- **GraphQL `Repository.mergeQueue`** for queue detection — replaces a
brittle REST probe
([#70](#70)).
- **Assessment checkpoints overhaul**: new GH-34/GH-35/GH-36,
follow_uses delegation for CodeQL/Scorecard, org_provides for
community-health files, broader licence/Dependabot/workflow targets,
plus reusable-workflow-pitfalls reference. Multiple false-positive
findings demoted to `info` to reduce assessment noise
([#56](#56),
[#57](#57),
[#58](#58),
[#59](#59),
[#60](#60),
[#61](#61),
[#62](#62),
[#63](#63),
[#64](#64),
[#65](#65),
[#73](#73)).
- **npm distribution** — the skill now also ships via
`@netresearch/agent-skill-coordinator`
([#54](#54),
[#55](#55)).
- **Release pipeline hardening** — dropped the deprecated `with: bump:`
block + `workflow_dispatch.bump` input so releases happen exclusively
via locally-signed tags, plus SLSA-provenance permissions on the caller
([#52](#52),
[#53](#53)).

### Release plan

After merge: tag main with a signed annotated tag, push, the
`skill-repo-skill` reusable workflow publishes archives + SHA256SUMS
with cosign + SLSA attestation, then narrative notes get applied via `gh
release edit ... --notes-file`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants