A bypass actor can merge a PR without approval, but auto-merge and the merge queue never let it

[gwenneg]

🏷️ Discussion Type

Bug

Body

I have a branch rule that requires one approval before merging. I added a GitHub App to the bypass list of that rule. The app can merge its own PRs with no approval when it calls the merge API directly. That works.

But if the app turns on auto-merge instead, the PR never merges. It stays blocked with "Review required" forever, even when all checks are green. The same happens with a merge queue: the PR never enters the queue. If the app tries to add the PR to the queue itself, GitHub refuses with "At least 1 approving review is required by reviewers with write access."

So the bypass only counts when the actor clicks merge or calls the merge API. It does not count for auto-merge or for the merge queue. I could not find this written anywhere, and the settings page does not warn about it.

I use Renovate, which opens dependency update PRs through a GitHub App and turns on auto-merge by default. With an approval rule and a bypass, none of those PRs ever merge. The only setup that works is to make Renovate call the merge API itself. That means no merge queue at all, and Renovate merges only one PR per run.

What I tested

I built a public test repository for this: https://github.com/gwenneg-mq-lab/mq-bypass-lab. All the PRs and their timelines are still there, and the README says which rules were on for each PR, with a link to every one of them. Each PR was opened by a private GitHub App running Renovate. The rules on main were: one required approval, one required check called ci that runs on pull requests and on merge groups, and in some tests a merge queue. Auto-merge is allowed in the repository settings. For every test that failed, I waited at least 20 minutes, then did something on the same PR that should work, to make sure the setup itself was fine.

PR	Branch rules	Who is on the bypass list	What I did	What happened
PR 1	ruleset, bypass mode "For pull requests only"	the app	app turned on auto-merge	still blocked after 23 minutes, "Review required"
PR 1	same	the app	I approved the PR	auto-merge merged it 24 seconds later
PR 2	ruleset, bypass mode "Always allow"	the app	app turned on auto-merge	still blocked after 20 minutes
PR 2	same	the app	app called the merge API	merged right away, even though the PR still showed "Review required"
PR 3	classic branch protection, app in "Allow specified actors to bypass required pull requests"	the app	app turned on auto-merge	still blocked after 20 minutes
PR 3	same	the app	app called the merge API	merged right away
PR 5	ruleset plus "Require merge queue"	the app	app turned on auto-merge	never entered the queue in 20 minutes
PR 5	same	the app	app called enqueuePullRequest	refused: "At least 1 approving review is required by reviewers with write access."
PR 5	same	the app	app called the merge API	refused: "Changes must be made through the merge queue"
PR 5	same	the app	I approved the PR	queued 17 seconds later, checks ran, merged in under 2 minutes
PR 6	same, but the app also bypasses the merge queue rule	the app	app called the merge API	merged right away and skipped the queue completely
PR 7	merge queue, no approval rule	nobody	app turned on auto-merge	queued 16 seconds later and merged by the queue
PR 9	ruleset, bypass list = "Repository admin" role	me, as a repository admin	I turned on auto-merge	still blocked after 20 minutes
PR 9	same plus "Require merge queue"	me	I called enqueuePullRequest	refused with the same message
PR 9	same, queue off	me	I called the merge API	merged right away
PR 10	ruleset, bypass list = "Organization admin"	me, as the organization owner	I turned on auto-merge	still blocked after 20 minutes
PR 10	same	me	I called the merge API	merged right away
PR 12	classic branch protection plus "Require merge queue"	the app	app turned on auto-merge	never entered the queue in 20 minutes
PR 12	same	the app	app called the merge API	refused: "Changes must be made through the merge queue At least 1 approving review is required by reviewers with write access."
PR 12	same	the app	app called enqueuePullRequest	refused with the same message
PR 12	same	the app	I approved the PR	queued 5 seconds later, merged by the queue 55 seconds after that

I tested with Renovate 43.268.1 and 44.111.4. The newer one tries to add the PR to the merge queue itself when the merge API refuses, and that is refused too.

The problems I see

1. Auto-merge ignores the bypass list. It works with rulesets and with classic branch protection, in both bypass modes, for apps and for people.
2. The merge queue ignores the bypass list too. Auto-merge never queues the PR, and enqueuePullRequest is refused.
3. If I add the app to the bypass list of the merge queue rule as well, its merges skip the queue with no warning. So there is no way to have a bot merge its own PRs through the queue on a branch that needs approvals.
4. Nothing in the settings page or in the docs says that the bypass only applies to direct merges. I only found out by testing.
5. The "Require merge queue" setting of classic branch protection is not in the REST or GraphQL API. I had to turn it on by hand in the browser to test it.

What I would expect

When someone on the bypass list turns on auto-merge or adds a PR to the merge queue, the approval rule should be treated as met, the same way it is when that person merges directly. If that is not how it is meant to work, the settings page should say so when a bypass actor is combined with auto-merge or a merge queue, and the docs should say it too.

Earlier reports

Other people have hit this before: #142206, #162623, #190610 and #203926 here, and on the Renovate side renovatebot/renovate#28156 and renovatebot/renovate#31315. None of them got an answer with a fix. I am opening this one because I now have a full public reproduction to point at.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[Harshul1484]

I couldn't find it documented either. GitHub's ruleset docs only describe bypass as something an actor uses when it merges or pushes. Auto-merge and the merge queue instead check whether the pull request itself meets the rules, so a required approval stays unmet no matter who turned auto-merge on. Your test repo shows exactly that.

Renovate's docs add to the confusion: for required reviews they point to the bypass option (automerge docs), which only helps while Renovate merges directly.

Two setups that work with a required approval:

1. Keep the bypass and let Renovate merge directly. With platformAutomerge: false, Renovate first tries a direct merge, which your bypass allows, and only falls back to the merge queue if that's refused (see "GitHub Merge Queue" in the same doc). That's the setup you found, with its one-merge-per-run limit.

2. Meet the rule instead of bypassing it. Have a second identity approve the Renovate PRs. Once the approval is there, auto-merge and the merge queue behave normally because nothing is blocking. That's what Renovate's renovate-approve helper apps do for the hosted Mend app. With your own private app, the equivalent is a small workflow that approves PRs opened by that app using a different GitHub App's token, since an app can't approve its own PRs.

Your test repo is a clean reproduction, so it's worth sending to GitHub through feedback or support as well. At the very least, the bypass setting should say that it doesn't apply to auto-merge or the merge queue.