Renovate auto merging MRs with failed pipeline

[gaeljw]

How are you running Renovate?

Self-hosted Renovate CLI

Which platform you running Renovate on?

GitLab (.com or self-hosted)

Which version of Renovate are you using?

44.52.1

Please tell us more about your question or problem

Hello folks,

I recently started to notice a behaviour that I had not observed previously: Renovate automerged some Merge Requests on GitLab even though the CI pipeline had failed.

It only ever happened on GitLab projects that did not enforce the setting "Merge checks > Pipelines must succeed". But until a few days ago, the very same MR was not automatically merged in case of failed pipeline.

ℹ️ Our Renovate version did not change recently whereas our GitLab version did (18.11.11 -> 19.3.1). This could be related to the GitLab upgrade triggering an unexpected* behaviour from Renovate.

(*): is it unexpected? That's debatable as you could argue that the project is misconfigured if it allows merging in case of pipeline failed. But still it was not happening until recently.

To be clear: I'm totally fine setting enforcing our projects have the setting "Merge checks > Pipelines must succeed", I'm just trying to make sure if this is intended behaviour or maybe a bug of Renovate.

Logs (if relevant)

Unfortunately I don't have DEBUG/INFO logs for when it happened.

I can share screenshot of what I see on these GitLab MRs that may be giving some hints.

Case 1:

Details

⬆️ Here, 16 hours ago Renovate merged even though the last pipeline was failing.

Interestingly, there was no pipeline 16 hours ago, the last one is from previous days (makes sense if the PR was not rebased/updated, no new pipeline triggered). What made Renovate decide 16 hours ago that it could merge? 🤷

Case 2:

Very similar, just to highlight it's not isolated.

Details

[gaeljw]

Sounds like it could be related to #45368

[RahulGautamSingh]

You're right. This is the same issue as #45368.

When Renovate turns on GitLab auto-merge, it waits until the MR is mergeable and has a pipeline. It accepts a failed pipeline and doesn't check that the pipeline belongs to the MR's latest commit.

If Renovate has just pushed and GitLab hasn't created a pipeline for that commit yet, PUT /merge with merge_when_pipeline_succeeds=true has no pipeline to wait for. Without "Pipelines must succeed", GitLab then merges straight away. The failed pipeline on the MR belongs to the previous commit. You should see a Renovate push in the MR activity shortly before the merge.

Workaround: enable Merge checks > Pipelines must succeed, or set "platformAutomerge": false.

The fix on our side is for tryPrAutomerge to require pipeline.sha === sha before enabling auto-merge.

I'll raise an issue for that. Thanks!

Issue : #46236