This repository was archived by the owner on Nov 4, 2026. It is now read-only.
Repository navigation
Commit f27eafa
ci(dependabot-auto-merge): turn the job off until the objectstack cutover (objectui#13497) (#13527)
<!-- claude-projects-attribution: {"github_login":"os-tesla"} -->
_Requested by **Tesla** · [project
thread](https://claude.ai/code/project/chan_01AXsQkLFKRdQCqQ3RTr6Jao?thread=cmsg_01AXsQkLFKRdQCqQ3RTr6JaoTQxYKRxtUGN5xTm23ThWwo)_
Fixes #13497
Part of objectstack-ai/objectstack#25677
Clause-②: no
Metadata-protocol: none
⛔ **Governed surface (`.github/workflows/**`, Tier H).** This PR stays a
draft until an APPROVED review from an authorized approver (os-zhuang or
hotlong) is on record; the merge-queue leg of the Governed Surface Queue
Guard refuses it otherwise. No agent seat approves it; the dispatch seat
lands it after the approval.
## 维护者速读(草稿)
- **改了什么:** 把 `dependabot-auto-merge.yml` 的唯一 job 关掉(`if:
false`),只改这一个文件,文件头写明原因和怎么恢复。
- **为什么改:** 这个 job 用 GITHUB_TOKEN 把 Dependabot PR 放进合并队列。GitHub 不会为
GITHUB_TOKEN 触发的事件启动 workflow,所以这个合并组永远没有检查在跑,要等约 63 分钟超时才被踢出;排在它后面的所有
PR(包括 objectui→objectstack 合并的各张卡)都干等。Dependabot 每次 rebase 都会重来一次。今天
10:54Z 又一次:#13438 的合并组 0 个 run,排在后面的 #13515 合并组 5/5 已绿,在等它。
- **风险与代价(含回滚):** 合并之后到 cutover 归档之前,Dependabot PR 不再被自动批准、入队或评论;要落某个
Dependabot PR 就手动入队。没有新增 secret,没有缩短队列超时,没有删任何 required check。回滚 = 把 job
的条件改回 `github.actor == 'dependabot[bot]'`(文件头写了),或者 revert 这个 PR。
- **席位意见:**
- **你要做的(一个动作):** 读完 diff 后在本 PR 点 Approve。
## What changes
One file, `.github/workflows/dependabot-auto-merge.yml`:
- The `dependabot` job's condition becomes `if: false`, with a one-line
pointer to the header.
- A new header block says why the job is off, what the ruling ruled out,
and how to turn it back on (restore `github.actor == 'dependabot[bot]'`,
and fix the GITHUB_TOKEN enqueue first).
- Every step is left as it was. Nothing else in the repository changes.
## Why
The job's last step enqueues with `gh pr merge --auto --squash
--match-head-commit` under `GITHUB_TOKEN`. GitHub starts no workflow run
for an event that `GITHUB_TOKEN` caused, so the merge group gets no
`merge_group` runs, its required checks never report, and it holds the
head of the queue until the check timeout removes it. The card's
measurements (the third removal, still pending when the card was filed,
is read from #13438's timeline):
| enqueued (`added_to_merge_queue`, by `github-actions[bot]`) | removed
(`removed_from_merge_queue`) | held |
|---|---|---|
| 2026-10-24 05:31Z | 06:35Z | 64 min |
| 2026-10-24 23:16Z | 2026-10-25 00:19Z | 63 min |
| 2026-10-25 02:34Z | 03:34Z | 60 min |
A fourth cycle was live while this PR was written: Dependabot
force-pushed #13438 at 10:40:58Z, `github-actions[bot]` enqueued it at
10:54:47Z, and at 11:55Z its merge group
(`gh-readonly-queue/main/pr-13438-…`, head `6523401e4b`) had **0**
workflow runs, while the group right behind it (#13515, enqueued by the
fleet App) had **5 of 5** runs at `success`, waiting.
The triage ruling on #13497 (comment 6393154205) chose the cheaper of
the card's two ways, because this repository is archived at the
objectstack-ai/objectstack#25677 cutover: stop enqueuing Dependabot pull
requests from Actions, by dropping the enqueue step or disabling the
workflow until cutover. ⛔ No App or PAT secret, no shorter queue
timeout, no dropped required checks.
### Why the whole job, not just the enqueue step
Both forms were measured against the tests that read this workflow:
| Form | `scripts/__tests__/dependabot-merge-gate.test.ts` |
|---|---|
| Delete the "Enqueue for merge" step only | **2 failed** / 33 passed:
"has no `gh pr merge` that is not behind a green gate" (its anti-vacuity
count reads 0) and "runs the gate script and tells it which SHA to
judge" (no `--match-head-commit` left) |
| `if: false` on the job (this PR) | 35 passed |
Dropping only the step would mean rewriting those two pins as well. It
would also keep the gate running on every Dependabot rebase in the
cutover window: one runner polling for up to 40 minutes, only to approve
a pull request that nothing enqueues. With the job off, the workflow
stays as it is, and the tests that pin it don't change.
## Verification (local, head `b3d92a46a4`)
| Gate | Exit / verdict |
|---|---|
| `node scripts/check-governed-queue-guard.mjs --test
.github/workflows/dependabot-auto-merge.yml` | 3 = GOVERNED
(`.github/workflows/**` x1), as expected |
| `node scripts/check-changeset-presence.mjs` | 0, no changeset owed |
| `check-control-bytes`, `check-action-ref-convention`,
`check-pre-install-import-graph` (`--self-test` and run),
`check-shell-escape-residue`, `check-governed-queue-guard --self-test`,
`check-required-check-set --self-test`, `check-bash32-floor`,
`check-new-cross-file-line-citations`, `check-doc-links` | 0 each |
| vitest, the four `scripts/__tests__` files that name this workflow | 0
(159 tests) |
| vitest, all of `scripts/__tests__` (under `os-verify-lock`) | 1: 5863
passed, 3 failed, all `Test timed out in 15000ms` in files that do not
read this workflow (`check-i18n-dead-keys`, `check-vi-mock-inherit`,
`dollar-dialect-alias-census`); the same three files re-run alone on
this head: 0 (259 tests) |
| YAML parse of the edited file | job `if` is the boolean `false`; 10
steps, unchanged |
What can't be tested on this PR: the workflow triggers only on a
Dependabot pull request, so this PR can't run the changed job. The check
comes after the merge: the next Dependabot force-push should produce a
skipped `dependabot` job and no `added_to_merge_queue` event.
## Acceptance notes
- Prose elsewhere still says this workflow approves and enqueues:
`content/docs/guide/ci-cd-pipeline.md` (workflow table row and the
"Dependabot Auto-Merge" section), `AGENTS.md` (the governed-surface list
and the merge-queue paragraph), the `dependabot-auto-merge.yml` reason
in `scripts/check-action-ref-convention.mjs`, and header comments in
`scripts/dependabot-merge-gate.mjs` and
`scripts/check-governed-queue-guard.mjs`. Not changed here: the card's
scope is the workflow, and the repository is archived at cutover. These
are reported to the dispatch seat.
- Fixing this doesn't clear the current queue head. The #13438 entry
enqueued at 10:54:47Z stays until its timeout, or until a maintainer
removes it from the queue.
- [x] Adds no product-specific widget, dialog, hook or string (see
AGENTS.md › Product-neutral renderer)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Session: `https://claude.ai/code/session_01DqwYJmM7nGqhoj84ZUJ9Cz`
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: os-zhuang <jack@objectstack.ai>1 parent 867b937 commit f27eafa
1 file changed
Lines changed: 27 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
| 17 | + | |
| 18 | + | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| 22 | + | |
| 23 | + | |
| 24 | + | |
| 25 | + | |
| 26 | + | |
| 27 | + | |
| 28 | + | |
| 29 | + | |
| 30 | + | |
| 31 | + | |
7 | 32 | | |
8 | 33 | | |
9 | 34 | | |
| |||
82 | 107 | | |
83 | 108 | | |
84 | 109 | | |
85 | | - | |
| 110 | + | |
| 111 | + | |
86 | 112 | | |
87 | 113 | | |
88 | 114 | | |
| |||
0 commit comments