cli-printing-press/.mergify.yml at main · MarcvsTvllivs/cli-printing-press · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
queue_rules:
  - name: default
    # Two-block setup (queue_conditions + merge_conditions) intentionally
    # flips Mergify into draft_pr mode so it can speculate on multiple
    # PRs in parallel (see merge_queue.max_parallel_checks below).
    #
    # The split is what makes draft_pr mode safe for our setup:
    #   - queue_conditions gate entry on the SOURCE PR -> Greptile and
    #     review-thread resolution are enforced here, against the human-
    #     reviewable PR where Greptile actually posts checks.
    #   - merge_conditions gate the actual merge after the speculative
    #     draft PR's CI passes -> only the CI checks that run on the
    #     bot-owned `mergify/merge-queue/*` branch are required. Greptile
    #     silent-skips bot branches by design (Mergify confirmed this is
    #     expected), so requiring it here would block every queued PR.
    #
    # merge_protections (further down) also gets injected while a source PR is
    # in the queue. Keep Greptile enforced before queue entry, then trust the
    # Mergify-managed `queued` state during merge because Greptile intentionally
    # skips the bot-owned speculative check branches.
    queue_conditions:
      - base = main
      # A draft PR can never merge (GitHub blocks it), but a PR converted
      # back to draft mid-queue keeps its stale Greptile success and would
      # otherwise hold a speculative-check slot it can never release.
      - "-draft"
      # All Greptile/human inline review threads must be resolved and no
      # requested-changes review may remain before the PR enters the queue.
      # Greptile Review's check_run going green only reflects the confidence
      # score, not whether inline findings are addressed; without these
      # conditions a PR with unresolved P0/P1 findings or stale requested
      # changes would auto-merge as soon as `ready-to-merge` is applied.
      - "#review-threads-unresolved = 0"
      - "#changes-requested-reviews-by = 0"
      - check-success = build-and-test
      - check-success = generated-test
      - check-success = go-lint
      - check-success = golden
      - check-success = pr-title
      - check-success = test
      # Mirrors .github/CODEOWNERS for security-sensitive paths, but lets
      # code-owner-authored PRs enter the queue without requiring a second
      # code owner to approve their own maintainer work. Non-code-owner PRs
      # touching these paths still require an explicit approval from tmchow
      # or mvanhorn.
      - or:
        - "-files ~= ^(\\.github/workflows/|\\.github/scripts/|scripts/|\\.github/CODEOWNERS$)"
        - author = tmchow
        - author = mvanhorn
        - approved-reviews-by = tmchow
        - approved-reviews-by = mvanhorn
      - or:
        - check-success = Greptile Review
        - check-neutral = Greptile Review
        - check-skipped = Greptile Review
        # release-please PRs are auto-generated changelog + version bumps;
        # Greptile reliably silent-skips them so no check-run is ever posted.
        - and:
          - head = release-please--branches--main
          - "title ~= ^chore\\(main\\): release"
    # Evaluated against the speculative draft PR. Intentionally omitted:
    #   - Greptile / review-threads — Greptile silent-skips bot branches,
    #     and draft PRs have no review threads; both are re-enforced on
    #     the source PR via queue_conditions + merge_protections.
    #   - pr-title — `.github/workflows/pr-title.yml` skips only titles
    #     starting with `merge queue:` (batch-mode prefix). In draft_pr
    #     mode the draft title format is not guaranteed to match, which
    #     would hang the check. Source PR title is already validated at
    #     queue_conditions entry and cannot change while queued, so the
    #     re-check on the draft is redundant.
    merge_conditions:
      - check-success = build-and-test
      - check-success = generated-test
      - check-success = go-lint
      - check-success = golden
      - check-success = test
    merge_method: squash
    # `update_method: merge` instead of `rebase` so the queue can update
    # fork PRs without `update_bot_account`. Mergify deprecated the
    # `rebase` + `update_bot_account` combination for fork PRs on
    # 2026-04-21 (removal 2026-07-01); the published migration path is
    # update_method=merge. The PR branch picks up a merge commit while
    # in the queue, but `merge_method: squash` collapses it on the way
    # to main, so the on-main history is unchanged.
    update_method: merge
    # OSS plan: batch_size must stay at 1 (raising it triggers the paid
    # "Merge Queue Batch" feature and dequeues PRs with a billing block).
    # max_parallel_checks below is a separate knob and is NOT paywalled.
    batch_size: 1
    checks_timeout: 60m

merge_queue:
  # Parallel speculation across queued PRs. Mergify creates up to N
  # `mergify/merge-queue/*` draft PRs concurrently and runs CI on each.
  # Free on the OSS plan; the paid feature is `batch_size > 1`, which
  # groups multiple PRs into one queue position. 5 is the OSS-plan
  # default/ceiling for parallel speculation.
  max_parallel_checks: 5
  queued_label: queued
  dequeued_label: dequeued
  status_comments: outcomes

merge_protections_settings:
  reporting_method: check-runs
  auto_merge_conditions:
    - label = ready-to-merge

merge_protections:
  - name: require-ready-label-and-ci
    if:
      - base = main
    success_conditions:
      - or:
        - label = ready-to-merge
        - and:
          - head = release-please--branches--main
          - "title ~= ^chore\\(main\\): release"
      # Mirrors the queue_conditions review-feedback rules. Belt-and-suspenders
      # so a queued PR that picks up new Greptile findings or requested-changes
      # state during the queue's CI re-run is held until the feedback is
      # addressed.
      - "#review-threads-unresolved = 0"
      - "#changes-requested-reviews-by = 0"
      - check-success = build-and-test
      - check-success = generated-test
      - check-success = go-lint
      - check-success = golden
      - check-success = pr-title
      - check-success = test
      # Mirrors .github/CODEOWNERS for security-sensitive paths, while
      # allowing code-owner authors to merge their own maintainer PRs.
      - or:
        - "-files ~= ^(\\.github/workflows/|\\.github/scripts/|scripts/|\\.github/CODEOWNERS$)"
        - author = tmchow
        - author = mvanhorn
        - approved-reviews-by = tmchow
        - approved-reviews-by = mvanhorn
      - or:
        # Source PRs already had to pass Greptile in queue_conditions before
        # Mergify added this label. During merge, checks are evaluated against
        # the speculative queue run where Greptile does not post.
        - label = queued
        # Defensive fallback for any queue-draft evaluation path.
        - head ~= ^mergify/merge-queue/
        - check-success = Greptile Review
        - check-neutral = Greptile Review
        - check-skipped = Greptile Review
        # release-please PRs are auto-generated changelog + version bumps;
        # Greptile reliably silent-skips them so no check-run is ever posted.
        - and:
          - head = release-please--branches--main
          - "title ~= ^chore\\(main\\): release"