Skip to content

fix(ci): restore CI-gated Renovate automerge - #395

Closed
castrojo wants to merge 7 commits into
mainfrom
fix/renovate-automerge-caller
Closed

fix(ci): restore CI-gated Renovate automerge#395
castrojo wants to merge 7 commits into
mainfrom
fix/renovate-automerge-caller

Conversation

@castrojo

@castrojo castrojo commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Summary

Restores secure automatic merging for eligible MergeRaptor Renovate updates while preserving the required CODEOWNERS review for all other pull requests.

  • Adds the local CI-completion caller targeting main.
  • Mints the MergeRaptor installation token for direct merge only after bot provenance and an all-pass, non-empty check rollup.
  • Documents the narrow branch-protection bypass and adds guardrail simulations.

Validation

  • actionlint .github/workflows/renovate-automerge.yml .github/workflows/reusable-renovate-automerge.yml
  • bash tests/validate_reusable_renovate_automerge.sh

Consumer validation

Consumer PR: projectbluefin/bluefin#961
Consumer CI run: https://github.com/projectbluefin/bluefin/actions/runs/31117880196
Out-of-org consumer impact: No API or action-interface change; behavior is confined to this repository’s protected-branch Renovate merge path.

Follow-up

After this PR merges and v1 advances, observe a qualifying Mergeraptor PR merge after all checks pass without human review.

Current blocker

GitHub did not dispatch PR workflows or report checks for this branch despite matching configured paths. Tracked in #398.

Jorge Castro and others added 6 commits August 6, 2026 19:03
Assisted-by: GPT-5.6 Terra via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: GPT-5.6 Terra via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: GPT-5.6 Terra via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: GPT-5.6 Terra via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Require authorized auto-merge enablement, defer cleanly on non-pass check rollups, and add targeted validation for the reusable Renovate automerge workflow.

Assisted-by: GPT-5.6 Terra via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Assisted-by: GPT-5.6 Terra via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@castrojo
castrojo force-pushed the fix/renovate-automerge-caller branch from 611c69b to 374be03 Compare August 6, 2026 23:08
@castrojo
castrojo marked this pull request as ready for review August 6, 2026 23:08
@castrojo
castrojo requested a review from p5 as a code owner August 6, 2026 23:08
Assisted-by: GPT-5.6 Terra via GitHub Copilot

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@castrojo

castrojo commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by the minimal Renovate platformAutomerge: false configuration fix; this workflow-based approach was overengineered.

@castrojo castrojo closed this Aug 6, 2026
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant