Protect reordered PRs during submit

Author: skarim

README.md

@@ -433,7 +433,7 @@ Push all branches and create/update PRs and the stack on GitHub.
 gh stack submit [flags]
 ```
 
-Pushes all active branches together atomically before creating or updating PRs. Atomicity applies to Git branch updates, not PR or stack API operations.
+Pushes all active branches together atomically before creating PRs or setting their final bases. For pending reorders, at-risk PRs temporarily target the trunk while branches are pushed. Atomicity applies to Git branch updates, not PR or stack API operations.
 
 After creating PRs, `submit` automatically creates a **Stack** on GitHub to link the PRs together. If the stack already exists on GitHub (e.g., from a previous submit), new PRs will be added to the top of the stack.
 

cmd/link_test.go

@@ -1679,6 +1679,7 @@ func TestLink_UpdateDeletedStack_FallsBackToCreate(t *testing.T) {
 }
 
 func TestLink_PushesBranchesBeforeResolution(t *testing.T) {
+	t.Setenv("GH_STACK_NO_ATOMIC", "")
 	var pushedBranches []string
 	var pushedRemote string
 

cmd/push_test.go

@@ -25,6 +25,7 @@ func newPushMock(tmpDir string, currentBranch string) *git.MockOps {
 }
 
 func TestPush_PushesAllBranches(t *testing.T) {
+	t.Setenv("GH_STACK_NO_ATOMIC", "")
 	s := stack.Stack{
 		Trunk: stack.BranchRef{Branch: "main"},
 		Branches: []stack.BranchRef{

cmd/submit.go

@@ -242,6 +242,13 @@ func runSubmit(cfg *config.Config, opts *submitOptions) error {
 		drafts = collected
 	}
 
+	if pendingModify {
+		if err := prepareReorderedPRs(cfg, client, s); err != nil {
+			cfg.Errorf("failed to prepare reordered PRs: %s", err)
+			return ErrSilent
+		}
+	}
+
 	if len(activeBranches) > 0 {
 		cfg.Printf("Pushing to %s...", remote)
 		if err := git.Push(remote, activeBranches, true, !opts.noAtomic); err != nil {
@@ -307,6 +314,35 @@ func runSubmit(cfg *config.Config, opts *submitOptions) error {
 	return nil
 }
 
+// Reversed PR relationships can cause indirect merges when the new heads are
+// pushed. Use the unchanged trunk until ensurePR restores the intended bases.
+func prepareReorderedPRs(cfg *config.Config, client github.ClientOps, s *stack.Stack) error {
+	for i, b := range s.Branches {
+		if b.IsSkipped() {
+			continue
+		}
+		pr, err := client.FindPRForBranch(b.Branch)
+		if err != nil {
+			return fmt.Errorf("looking up PR for %s: %w", b.Branch, err)
+		}
+		if pr == nil || s.IndexOf(pr.BaseRefName) <= i {
+			continue
+		}
+		if pr.IsAutoMergeEnabled() {
+			if err := client.DisableAutoMerge(pr.ID); err != nil {
+				return fmt.Errorf("disabling auto-merge for PR #%d: %w", pr.Number, err)
+			}
+			cfg.Warningf("Disabled auto-merge for PR %s (incompatible with stacked PRs)",
+				cfg.PRLink(pr.Number, pr.URL))
+		}
+		if err := client.UpdatePRBase(pr.Number, s.Trunk.Branch); err != nil {
+			return fmt.Errorf("temporarily setting base of PR #%d to %s: %w", pr.Number, s.Trunk.Branch, err)
+		}
+		cfg.Successf("Temporarily set base of PR %s to %s", cfg.PRLink(pr.Number, pr.URL), s.Trunk.Branch)
+	}
+	return nil
+}
+
 // collectPRDrafts loads branch display data and runs the interactive submit TUI
 // so the user can choose which new branches become PRs and draft each one. It
 // returns the per-branch overrides, whether the user cancelled, and any error.

cmd/submit_test.go

@@ -94,6 +94,7 @@ func newSubmitMock(tmpDir string, currentBranch string) *git.MockOps {
 }
 
 func TestSubmit_CreatesPRsAndStack(t *testing.T) {
+	t.Setenv("GH_STACK_NO_ATOMIC", "")
 	s := stack.Stack{
 		Trunk: stack.BranchRef{Branch: "main"},
 		Branches: []stack.BranchRef{
@@ -1885,6 +1886,8 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 		retry             bool
 		mergeOnRetry      bool
 		mergeAfterUnstack bool
+		reorder           bool
+		noAtomic          bool
 	}{
 		{name: "one existing PR", branches: 1},
 		{name: "last PR merged while unstacking", branches: 1, mergeAfterUnstack: true},
@@ -1901,6 +1904,10 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 		{name: "one PR lost during final refresh", branches: 1, failure: "refresh"},
 		{name: "one PR after partial unstack", branches: 1, mergedBase: true},
 		{name: "multiple PRs complete", branches: 3},
+		{name: "reordered PRs", branches: 3, reorder: true},
+		{name: "reordered PRs non-atomic", branches: 3, reorder: true, noAtomic: true},
+		{name: "reordered PRs preparation fails", branches: 3, reorder: true, failure: "prepare", retry: true},
+		{name: "reordered PRs push fails", branches: 3, reorder: true, failure: "push", retry: true},
 		{name: "multiple PRs after partial unstack", branches: 3, mergedBase: true},
 		{name: "retry push after partial unstack", branches: 3, mergedBase: true, failure: "push", retry: true},
 		{name: "released PR merged before retry", branches: 3, mergedBase: true, failure: "push", retry: true, mergeOnRetry: true},
@@ -1933,14 +1940,14 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 					if i > 0 {
 						base = fmt.Sprintf("b%d", i)
 					}
-					if name == target {
+					if name == target && !tc.reorder {
 						base = "removed"
 					}
 					prs[name] = &github.PullRequest{
 						Number: 10 + i, ID: fmt.Sprintf("PR_%d", 10+i), State: "OPEN",
 						HeadRefName: name, BaseRefName: base,
 					}
-					if tc.failure == "auto-merge" && name == target {
+					if (tc.failure == "auto-merge" || tc.reorder) && name == target {
 						prs[name].AutoMergeRequest = &github.AutoMergeRequest{EnabledAt: "2026-09-29T00:00:00Z"}
 					}
 					prs[name].IsDraft = tc.failure == "ready" && name == target
@@ -1949,6 +1956,9 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 				}
 				s.Branches = append(s.Branches, br)
 			}
+			if tc.reorder {
+				s.Branches[1], s.Branches[2] = s.Branches[2], s.Branches[1]
+			}
 			writeStackFile(t, dir, s)
 			pending := newPendingSubmitState("42")
 			if tc.priorDeleted {
@@ -1958,8 +1968,12 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 			saveModifyState(t, dir, pending)
 			mock := newSubmitMock(dir, "b1")
 			var pushes []string
-			mock.PushFn = func(_ string, branches []string, _, _ bool) error {
+			mock.PushFn = func(_ string, branches []string, _, atomic bool) error {
 				require.NotEmpty(t, branches)
+				if tc.reorder {
+					assert.Equal(t, "main", prs[target].BaseRefName, "detach the reversed PR base before pushing")
+					assert.Equal(t, !tc.noAtomic, atomic)
+				}
 				pushes = append(pushes, branches...)
 				if tc.failure == "push" && slices.Contains(branches, target) {
 					return assert.AnError
@@ -2050,19 +2064,35 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 				},
 				UpdatePRBaseFn: func(number int, base string) error {
 					baseUpdates++
-					if tc.failure == "base" {
+					if tc.failure == "base" || tc.failure == "prepare" {
 						return assert.AnError
 					}
-					require.Equal(t, prs[target].Number, number)
-					prs[target].BaseRefName = base
+					if !tc.reorder {
+						require.Equal(t, prs[target].Number, number)
+					}
+					for _, pr := range prs {
+						if pr.Number == number {
+							if tc.reorder {
+								assert.False(t, pr.IsAutoMergeEnabled(), "disable auto-merge before changing bases")
+							}
+							pr.BaseRefName = base
+						}
+					}
 					if tc.failure == "save" {
 						var err error
 						catalogLock, err = stack.Lock(dir)
 						require.NoError(t, err)
 					}
 					return nil
 				},
-				DisableAutoMergeFn:     func(string) error { return assert.AnError },
+				DisableAutoMergeFn: func(id string) error {
+					if tc.failure == "auto-merge" {
+						return assert.AnError
+					}
+					require.Equal(t, prs[target].ID, id)
+					prs[target].AutoMergeRequest = nil
+					return nil
+				},
 				MarkPRReadyForReviewFn: func(string) error { return assert.AnError },
 				CreateStackFn: func(numbers []int) (*github.RemoteStack, error) {
 					require.GreaterOrEqual(t, len(numbers), 2)
@@ -2077,7 +2107,7 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 			cfg, outR, errR := config.NewTestConfig()
 			cfg.GitHubClientOverride = client
 
-			err := runSubmit(cfg, &submitOptions{auto: true, open: tc.failure == "ready"})
+			err := runSubmit(cfg, &submitOptions{auto: true, open: tc.failure == "ready", noAtomic: tc.noAtomic})
 
 			_, output := commandOutput(t, cfg, outR, errR)
 			if tc.failure != "" {
@@ -2090,6 +2120,9 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 				assert.NotContains(t, output, "Stack recreated")
 				assert.NotContains(t, output, "Changes from modify submitted")
 				assert.Nil(t, replacement, "an incomplete modification must not create a partial replacement stack")
+				if tc.failure == "prepare" {
+					assert.Empty(t, pushes, "do not push unless all reversed bases were detached")
+				}
 			} else {
 				require.NoError(t, err, output)
 				assert.NoFileExists(t, modify.StatePath(dir))
@@ -2113,6 +2146,8 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 				assert.Contains(t, output, "Changes from modify submitted")
 				if tc.newPR {
 					assert.Equal(t, 1, createdPRs)
+				} else if tc.reorder {
+					assert.Equal(t, 3, baseUpdates)
 				} else if !tc.mergeAfterUnstack {
 					assert.Equal(t, 1, baseUpdates)
 				}
@@ -2129,7 +2164,7 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 				pushStart := len(pushes)
 				retryCfg, retryOut, retryErr := config.NewTestConfig()
 				retryCfg.GitHubClientOverride = client
-				err := runSubmit(retryCfg, &submitOptions{auto: true})
+				err := runSubmit(retryCfg, &submitOptions{auto: true, noAtomic: tc.noAtomic})
 				_, diagnostics := commandOutput(t, retryCfg, retryOut, retryErr)
 				require.NoError(t, err, diagnostics)
 				assert.NoFileExists(t, modify.StatePath(dir))
@@ -2153,6 +2188,12 @@ func TestSubmit_PendingModifyCompletion(t *testing.T) {
 			} else {
 				assert.Equal(t, 1, unstackCalls)
 			}
+			if tc.reorder {
+				assert.Equal(t, "b1", prs["b3"].BaseRefName)
+				assert.Equal(t, "b3", prs["b2"].BaseRefName)
+				require.NotNil(t, replacement)
+				assert.Equal(t, []int{10, 12, 11}, replacement.PullRequests)
+			}
 		})
 	}
 }
@@ -2540,6 +2581,7 @@ func TestClearPendingModifyState_NoFile(t *testing.T) {
 }
 
 func TestSubmit_WithPendingModify_AtomicPush(t *testing.T) {
+	t.Setenv("GH_STACK_NO_ATOMIC", "")
 	s := stack.Stack{
 		ID:     "42",
 		Number: 7,

cmd/sync_test.go

@@ -76,6 +76,7 @@ func newSyncMock(tmpDir string, currentBranch string) *git.MockOps {
 // TestSync_TrunkAlreadyUpToDate verifies that when trunk and origin/trunk have
 // the same SHA, no rebase occurs and push is normal (not force).
 func TestSync_TrunkAlreadyUpToDate(t *testing.T) {
+	t.Setenv("GH_STACK_NO_ATOMIC", "")
 	s := stack.Stack{
 		Trunk: stack.BranchRef{Branch: "main"},
 		Branches: []stack.BranchRef{
@@ -642,6 +643,7 @@ func TestSync_NoRebaseWhenTrunkDidntMove(t *testing.T) {
 // TestSync_PushForceFlagDependsOnRebase verifies that the force flag on Push
 // correlates with whether a rebase actually happened.
 func TestSync_PushForceFlagDependsOnRebase(t *testing.T) {
+	t.Setenv("GH_STACK_NO_ATOMIC", "")
 	tests := []struct {
 		name          string
 		trunkMoved    bool

docs/src/content/docs/reference/cli.md

@@ -350,7 +350,7 @@ gh stack submit [flags]
 | `--remote <name>` | Remote to push to (defaults to auto-detected remote) |
 | `--no-atomic` | Allow partial branch updates |
 
-Pushes all active branches together atomically before creating or updating PRs. After creating PRs, `submit` automatically creates a **Stack** on GitHub to link the PRs together. If the stack already exists on GitHub (e.g., from a previous submit), new PRs are added to the existing stack. Atomicity applies to Git branch updates, not PR or stack API operations.
+Pushes all active branches together atomically before creating PRs or setting their final bases. For pending reorders, at-risk PRs temporarily target the trunk while branches are pushed. After creating PRs, `submit` automatically creates a **Stack** on GitHub to link the PRs together. If the stack already exists on GitHub (e.g., from a previous submit), new PRs are added to the existing stack. Atomicity applies to Git branch updates, not PR or stack API operations.
 
 If every PR in the stack has already been merged, that stack is complete and can't be extended. In that case `submit` automatically starts a **new** stack rooted at the trunk for your unmerged branches and creates it on GitHub, leaving the merged stack untouched.