From bd0485ec92268e42f97a2b513ba883bd72ac4ddb Mon Sep 17 00:00:00 2001 From: bigboateng Date: Tue, 28 Jul 2026 11:34:54 +0100 Subject: [PATCH] install protected native auto-merge request --- .github/workflows/sync-upstream.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml index d8d7bc5..dc22cb1 100644 --- a/.github/workflows/sync-upstream.yml +++ b/.github/workflows/sync-upstream.yml @@ -25,7 +25,7 @@ jobs: sync: runs-on: ubuntu-latest steps: - - name: Create publisher token + - name: Create Operator Stack Publisher token id: app-token uses: actions/create-github-app-token@v3 with: @@ -109,5 +109,13 @@ jobs: --body-file "$body_file")" echo "Opened generated PR: $pr_url" else + pr_url="$existing" echo "Updated existing PR: $existing" fi + required_checks="$(gh api "repos/operatorstack/interlock/branches/main/protection/required_status_checks" --jq '(.contexts // []) + ([.checks[]?.context] // []) | unique | length')" + if [[ "$required_checks" -lt 1 ]]; then + echo "BLOCKED: main has no required status checks; refusing unsafe auto-merge." >&2 + exit 1 + fi + gh pr merge "$pr_url" --auto --squash + echo "Native auto-merge requested; branch protection owns merge eligibility."