Skip to content
This repository was archived by the owner on Nov 4, 2026. It is now read-only.

Commit f27eafa

Browse files
objectstack-fleet[bot]claudeos-zhuang
authored
ci(dependabot-auto-merge): turn the job off until the objectstack cutover (objectui#13497) (#13527)
<!-- claude-projects-attribution: {"github_login":"os-tesla"} --> _Requested by **Tesla** · [project thread](https://claude.ai/code/project/chan_01AXsQkLFKRdQCqQ3RTr6Jao?thread=cmsg_01AXsQkLFKRdQCqQ3RTr6JaoTQxYKRxtUGN5xTm23ThWwo)_ Fixes #13497 Part of objectstack-ai/objectstack#25677 Clause-②: no Metadata-protocol: none ⛔ **Governed surface (`.github/workflows/**`, Tier H).** This PR stays a draft until an APPROVED review from an authorized approver (os-zhuang or hotlong) is on record; the merge-queue leg of the Governed Surface Queue Guard refuses it otherwise. No agent seat approves it; the dispatch seat lands it after the approval. ## 维护者速读(草稿) - **改了什么:** 把 `dependabot-auto-merge.yml` 的唯一 job 关掉(`if: false`),只改这一个文件,文件头写明原因和怎么恢复。 - **为什么改:** 这个 job 用 GITHUB_TOKEN 把 Dependabot PR 放进合并队列。GitHub 不会为 GITHUB_TOKEN 触发的事件启动 workflow,所以这个合并组永远没有检查在跑,要等约 63 分钟超时才被踢出;排在它后面的所有 PR(包括 objectui→objectstack 合并的各张卡)都干等。Dependabot 每次 rebase 都会重来一次。今天 10:54Z 又一次:#13438 的合并组 0 个 run,排在后面的 #13515 合并组 5/5 已绿,在等它。 - **风险与代价(含回滚):** 合并之后到 cutover 归档之前,Dependabot PR 不再被自动批准、入队或评论;要落某个 Dependabot PR 就手动入队。没有新增 secret,没有缩短队列超时,没有删任何 required check。回滚 = 把 job 的条件改回 `github.actor == 'dependabot[bot]'`(文件头写了),或者 revert 这个 PR。 - **席位意见:** - **你要做的(一个动作):** 读完 diff 后在本 PR 点 Approve。 ## What changes One file, `.github/workflows/dependabot-auto-merge.yml`: - The `dependabot` job's condition becomes `if: false`, with a one-line pointer to the header. - A new header block says why the job is off, what the ruling ruled out, and how to turn it back on (restore `github.actor == 'dependabot[bot]'`, and fix the GITHUB_TOKEN enqueue first). - Every step is left as it was. Nothing else in the repository changes. ## Why The job's last step enqueues with `gh pr merge --auto --squash --match-head-commit` under `GITHUB_TOKEN`. GitHub starts no workflow run for an event that `GITHUB_TOKEN` caused, so the merge group gets no `merge_group` runs, its required checks never report, and it holds the head of the queue until the check timeout removes it. The card's measurements (the third removal, still pending when the card was filed, is read from #13438's timeline): | enqueued (`added_to_merge_queue`, by `github-actions[bot]`) | removed (`removed_from_merge_queue`) | held | |---|---|---| | 2026-10-24 05:31Z | 06:35Z | 64 min | | 2026-10-24 23:16Z | 2026-10-25 00:19Z | 63 min | | 2026-10-25 02:34Z | 03:34Z | 60 min | A fourth cycle was live while this PR was written: Dependabot force-pushed #13438 at 10:40:58Z, `github-actions[bot]` enqueued it at 10:54:47Z, and at 11:55Z its merge group (`gh-readonly-queue/main/pr-13438-…`, head `6523401e4b`) had **0** workflow runs, while the group right behind it (#13515, enqueued by the fleet App) had **5 of 5** runs at `success`, waiting. The triage ruling on #13497 (comment 6393154205) chose the cheaper of the card's two ways, because this repository is archived at the objectstack-ai/objectstack#25677 cutover: stop enqueuing Dependabot pull requests from Actions, by dropping the enqueue step or disabling the workflow until cutover. ⛔ No App or PAT secret, no shorter queue timeout, no dropped required checks. ### Why the whole job, not just the enqueue step Both forms were measured against the tests that read this workflow: | Form | `scripts/__tests__/dependabot-merge-gate.test.ts` | |---|---| | Delete the "Enqueue for merge" step only | **2 failed** / 33 passed: "has no `gh pr merge` that is not behind a green gate" (its anti-vacuity count reads 0) and "runs the gate script and tells it which SHA to judge" (no `--match-head-commit` left) | | `if: false` on the job (this PR) | 35 passed | Dropping only the step would mean rewriting those two pins as well. It would also keep the gate running on every Dependabot rebase in the cutover window: one runner polling for up to 40 minutes, only to approve a pull request that nothing enqueues. With the job off, the workflow stays as it is, and the tests that pin it don't change. ## Verification (local, head `b3d92a46a4`) | Gate | Exit / verdict | |---|---| | `node scripts/check-governed-queue-guard.mjs --test .github/workflows/dependabot-auto-merge.yml` | 3 = GOVERNED (`.github/workflows/**` x1), as expected | | `node scripts/check-changeset-presence.mjs` | 0, no changeset owed | | `check-control-bytes`, `check-action-ref-convention`, `check-pre-install-import-graph` (`--self-test` and run), `check-shell-escape-residue`, `check-governed-queue-guard --self-test`, `check-required-check-set --self-test`, `check-bash32-floor`, `check-new-cross-file-line-citations`, `check-doc-links` | 0 each | | vitest, the four `scripts/__tests__` files that name this workflow | 0 (159 tests) | | vitest, all of `scripts/__tests__` (under `os-verify-lock`) | 1: 5863 passed, 3 failed, all `Test timed out in 15000ms` in files that do not read this workflow (`check-i18n-dead-keys`, `check-vi-mock-inherit`, `dollar-dialect-alias-census`); the same three files re-run alone on this head: 0 (259 tests) | | YAML parse of the edited file | job `if` is the boolean `false`; 10 steps, unchanged | What can't be tested on this PR: the workflow triggers only on a Dependabot pull request, so this PR can't run the changed job. The check comes after the merge: the next Dependabot force-push should produce a skipped `dependabot` job and no `added_to_merge_queue` event. ## Acceptance notes - Prose elsewhere still says this workflow approves and enqueues: `content/docs/guide/ci-cd-pipeline.md` (workflow table row and the "Dependabot Auto-Merge" section), `AGENTS.md` (the governed-surface list and the merge-queue paragraph), the `dependabot-auto-merge.yml` reason in `scripts/check-action-ref-convention.mjs`, and header comments in `scripts/dependabot-merge-gate.mjs` and `scripts/check-governed-queue-guard.mjs`. Not changed here: the card's scope is the workflow, and the repository is archived at cutover. These are reported to the dispatch seat. - Fixing this doesn't clear the current queue head. The #13438 entry enqueued at 10:54:47Z stays until its timeout, or until a maintainer removes it from the queue. - [x] Adds no product-specific widget, dialog, hook or string (see AGENTS.md › Product-neutral renderer) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Session: `https://claude.ai/code/session_01DqwYJmM7nGqhoj84ZUJ9Cz` Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: os-zhuang <jack@objectstack.ai>
1 parent 867b937 commit f27eafa

1 file changed

Lines changed: 27 additions & 1 deletion

File tree

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,31 @@ on:
44
pull_request:
55
branches: [main, develop]
66

7+
# ── Off until the objectstack cutover (objectui#13497) ─────────────────────────
8+
#
9+
# The job below carries `if: false`. Its last step enqueues with `gh pr merge
10+
# --auto` under GITHUB_TOKEN, and GitHub starts no workflow run for an event that
11+
# GITHUB_TOKEN caused. So the merge group it creates gets no `merge_group` runs,
12+
# the required checks never report on it, and the entry holds the head of the
13+
# merge queue until the queue's check timeout removes it, with every pull request
14+
# behind it waiting the whole time. Each Dependabot force-push re-ran this job and
15+
# re-enqueued, so the stall repeated. The measurements are on objectui#13497.
16+
#
17+
# This repository is archived when objectstack-ai/objectstack#25677 moves objectui
18+
# into objectstack, so the ruling on objectui#13497 took the cheaper fix: stop
19+
# enqueuing Dependabot pull requests from Actions. ⛔ No App or PAT secret was
20+
# added for an enqueue that runs, the queue timeout was not shortened, and no
21+
# required check was dropped.
22+
#
23+
# The whole job is off, not only its enqueue step: without the enqueue it would
24+
# still hold a runner for every Dependabot rebase in the cutover window, only to
25+
# approve a pull request that nothing enqueues. Everything else here is left as it
26+
# was. Until the cutover, nothing approves, enqueues or comments on a Dependabot
27+
# pull request; one lands only if someone enqueues it by hand once its checks are
28+
# green. To turn the job back on, give it back the condition `if: false` replaced,
29+
# `github.actor == 'dependabot[bot]'`, and fix the GITHUB_TOKEN enqueue first, or
30+
# the stall returns with it.
31+
732
# ── Why this workflow no longer enables auto-merge unconditionally (#4973) ────
833
#
934
# It used to run, for every semver-patch/minor bump and with nothing else asked:
@@ -82,7 +107,8 @@ concurrency:
82107
jobs:
83108
dependabot:
84109
runs-on: ubuntu-latest
85-
if: ${{ github.actor == 'dependabot[bot]' }}
110+
# Off until the objectstack cutover: see the header (objectui#13497).
111+
if: false
86112
# The gate waits for the slowest check in the repository. Measured on #4959
87113
# the last required context reported 9m26s after the jobs started, so the
88114
# script's own deadline is 40 minutes (`GATE_TIMEOUT_SECONDS`) and the job is

0 commit comments

Comments
 (0)