Skip to content

fix: auto-queue re-enables auto-merge on ejected PRs - #276

Merged
omer-vishlitzky merged 3 commits into
osac-project:mainfrom
omer-vishlitzky:fix/auto-queue-schedule
Aug 11, 2026
Merged

fix: auto-queue re-enables auto-merge on ejected PRs#276
omer-vishlitzky merged 3 commits into
osac-project:mainfrom
omer-vishlitzky:fix/auto-queue-schedule

Conversation

@omer-vishlitzky

@omer-vishlitzky omer-vishlitzky commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Summary

When the merge queue ejects a PR (timeout, failed checks, conflicts), GitHub disables auto-merge. No PR event fires, so the event-driven auto-queue never re-enables it — ejected PRs sit dead.

Adds a scheduled job (every 10 min) that scans for open PRs with:

  • All required labels (lgtm, approved, jira/valid-reference)
  • No blocking labels (do-not-merge/hold, needs-rebase)
  • Not draft
  • Auto-merge not currently enabled

Re-enables auto-merge with --rebase on each match.

Test plan

  • Eject a PR from the queue manually, verify it gets re-enqueued within 10 min
  • Verify PRs with blocking labels are not re-queued
  • Verify draft PRs are not re-queued

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Automation
    • Added periodic checks to identify eligible open pull requests.
    • Automatically re-enables pull request auto-merge when required approvals are present and no blocking conditions apply.
    • Preserves existing event-based auto-merge behavior while excluding scheduled runs.
    • Logs individual failures without stopping processing of other pull requests.

When the merge queue ejects a PR (timeout, failed checks, conflicts),
GitHub disables auto-merge. No PR event fires, so the event-driven
auto-queue never re-enables it. Add a scheduled job that scans for
open PRs with all required labels, no blocking labels, not draft, and
no auto-merge enabled, then re-enables auto-merge on each.

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
@openshift-ci
openshift-ci Bot requested review from ori-amizur and tzvatot August 11, 2026 22:10
@openshift-ci

openshift-ci Bot commented Aug 11, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: omer-vishlitzky

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Aug 11, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@omer-vishlitzky, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bd4a234a-da68-48e0-b718-4fe8b9d8c617

📥 Commits

Reviewing files that changed from the base of the PR and between 6514b50 and 1cabc22.

📒 Files selected for processing (1)
  • .github/workflows/auto-queue.yml

Walkthrough

The auto-queue workflow now runs every ten minutes. A scheduled job finds eligible open pull requests and enables rebase auto-merge. Pull-request-triggered runs continue to use the existing auto-merge job.

Changes

Auto-queue requeue flow

Layer / File(s) Summary
Schedule and event gating
.github/workflows/auto-queue.yml
The workflow adds a ten-minute schedule. The existing enable-auto-merge job runs only for non-scheduled events.
Eligible pull request requeue
.github/workflows/auto-queue.yml
The scheduled job filters draft status, auto-merge state, required labels, and blocking labels. It enables rebase auto-merge for selected pull requests and logs per-pull-request failures.
Estimated code review effort: 2 (Simple) ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActionsScheduler
  participant AutoQueueWorkflow
  participant GitHubCLI
  participant OpenPullRequests
  GitHubActionsScheduler->>AutoQueueWorkflow: Start scheduled run
  AutoQueueWorkflow->>GitHubCLI: List open pull requests
  GitHubCLI->>OpenPullRequests: Read draft, auto-merge, and label state
  OpenPullRequests-->>AutoQueueWorkflow: Return pull request data
  AutoQueueWorkflow->>GitHubCLI: Enable rebase auto-merge for eligible pull requests
Loading

Possibly related PRs

🚥 Pre-merge checks | ✅ 11
✅ Passed checks (11 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the scheduled auto-merge re-enablement for ejected pull requests.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets ✅ Passed The only changed file adds workflow logic; its GH_TOKEN uses the existing secrets.MERGE_QUEUE_TOKEN reference, and no hardcoded secret shape appears in added lines.
No-Weak-Crypto ✅ Passed The PR only adds scheduled GitHub Actions logic and gh commands; the diff introduces no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret comparisons.
No-Injection-Vectors ✅ Passed The added job uses a static jq filter and quotes API-derived $pr; repository context is also quoted. The diff adds no listed injection sink.
Container-Privileges ✅ Passed The diff adds a scheduled GitHub Actions job only; it introduces no container, privilege, host namespace, SYS_ADMIN, or root settings.
No-Sensitive-Data-In-Logs ✅ Passed The added logs contain only static messages and public PR numbers. They do not print tokens, credentials, labels, email addresses, or customer data; existing author/label logs are unchanged.
Ai-Attribution ✅ Passed PR description and commit mention Claude Code; the PR commit includes an Assisted-by trailer and no AI Co-Authored-By trailer.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@fullsend-ai-review

fullsend-ai-review Bot commented Aug 11, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 10:11 PM UTC · Completed 10:25 PM UTC

Commit: 6514b50 · View workflow run →

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/auto-queue.yml:
- Around line 75-81: Update the gh pr list invocation in the auto-merge
candidate query to request all relevant open pull requests by setting an
explicit sufficiently high --limit or enabling pagination. Preserve the existing
jq eligibility filtering and number output while ensuring candidates beyond the
default 30-result page are processed.
- Around line 82-85: Update the auto-merge requeue loop to track whether any gh
pr merge invocation fails, continue processing remaining pull requests, and exit
non-zero after the loop when failures occurred instead of masking them with
echo. Also configure gh pr list to paginate through all pull requests rather
than limiting results to the default 30.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4d0d4377-f731-41d7-be72-617a4d0b848d

📥 Commits

Reviewing files that changed from the base of the PR and between 9cf778c and 6514b50.

📒 Files selected for processing (1)
  • .github/workflows/auto-queue.yml

Comment thread .github/workflows/auto-queue.yml Outdated
Comment thread .github/workflows/auto-queue.yml Outdated
Comment on lines +82 to +85
' | while read -r pr; do
echo "Re-enabling auto-merge on PR #$pr"
gh pr merge "$pr" --repo "${{ github.repository }}" --auto --rebase || echo "Failed to enable auto-merge on PR #$pr"
done

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
file=".github/workflows/auto-queue.yml"
wc -l "$file"
cat -n "$file"
printf '\n--- workflow diff stat ---\n'
git diff --stat -- "$file"
printf '\n--- relevant commands ---\n'
rg -n -C 4 'gh pr list|gh pr merge|while read|permissions:|set -e|pull_request|schedule' "$file"

Repository: osac-project/osac

Length of output: 7204


🌐 Web query:

GitHub CLI gh pr list default limit pagination documentation

💡 Result:

The GitHub CLI command gh pr list has a default limit of 30 items [1][2]. To change the number of items fetched, you can use the --limit (or -L) flag followed by the desired number [1][3]. For example, running gh pr list --limit 100 will fetch up to 100 pull requests. Regarding pagination and totals: - The gh pr list command treats the --limit flag as a cap for the current command call [3][4]. - It does not natively expose aggregate total counts (such as totalCount) when using --json output [3][4]. - If you require a true total count of pull requests, the recommended approach is to use the gh api command to query the GitHub GraphQL API directly [3][4]. - For advanced pagination scenarios or fetching more than a single set of results, you can use gh api with the --paginate flag, often combined with --jq to process the output [3][4].

Citations:


🏁 Script executed:

#!/bin/bash
set -u

printf '%s\n' '--- merge failure is masked ---'
(
  set -o pipefail
  gh() {
    if [[ "$1 $2" == "pr list" ]]; then
      printf '123\n'
    else
      return 9
    fi
  }
  gh pr list | while read -r pr; do
    gh pr merge "$pr" --auto --rebase || echo "Failed to enable auto-merge on PR #$pr"
  done
  printf 'pipeline_status=%s\n' "$?"
)

printf '%s\n' '--- listing failure remains detectable only when the loop does not mask it ---'
(
  set -o pipefail
  gh() {
    if [[ "$1 $2" == "pr list" ]]; then
      return 7
    fi
  }
  set +e
  gh pr list | while read -r pr; do
    :
  done
  printf 'listing_pipeline_status=%s\n' "$?"
)

Repository: osac-project/osac

Length of output: 349


Propagate requeue failures.

When gh pr merge fails, || echo ... makes the loop return success. The scheduled job can report success while auto-merge remains disabled. Accumulate failures and exit non-zero after processing all pull requests. Also paginate gh pr list, which otherwise returns only 30 pull requests.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-queue.yml around lines 82 - 85, Update the auto-merge
requeue loop to track whether any gh pr merge invocation fails, continue
processing remaining pull requests, and exit non-zero after the loop when
failures occurred instead of masking them with echo. Also configure gh pr list
to paginate through all pull requests rather than limiting results to the
default 30.

Source: MCP tools

@fullsend-ai-review

Copy link
Copy Markdown

Review

Findings

High

  • [protected-path] .github/workflows/auto-queue.yml — This PR modifies a file under the protected path .github/. The PR has no linked issue providing authorization for modifying governance/infrastructure files. Human approval is required for protected-path changes.

Medium

  • [edge-case] .github/workflows/auto-queue.yml:75gh pr list defaults to returning only 30 results. If the repository has more than 30 open PRs, eligible PRs beyond the first page will be silently skipped and never have auto-merge re-enabled.
    Remediation: Add --limit 200 (or a suitably large number) to the gh pr list command.

  • [permission-expansion] .github/workflows/auto-queue.yml:1 — The workflow has no top-level permissions: block. Without explicit permission scoping, the workflow inherits the repository's default token permissions. Nearly every other workflow in this repository explicitly sets permissions. Adding a restrictive permissions block follows least-privilege and matches the repository convention.
    Remediation: Add a top-level permissions: {} block to restrict the default GITHUB_TOKEN.

Low

  • [logic-error] .github/workflows/auto-queue.yml:66 — The requeue-eligible-prs job does not check whether the PR author is a repository collaborator before re-enabling auto-merge. The event-driven enable-auto-merge job gates on collaborator status, but the scheduled job bypasses this. The practical risk is low since the required labels (lgtm, approved, jira/valid-reference) are Prow-managed via OWNERS files, making it unlikely a non-collaborator PR would acquire all three.

  • [error-handling] .github/workflows/auto-queue.yml:75 — The gh pr list ... | while read -r pr pipeline means failures from gh pr list (network error, auth failure, rate limiting) are swallowed. The step exits 0 with no indication the scan never ran.
    Remediation: Use set -euo pipefail or capture the output into a variable first.

  • [permission-expansion] .github/workflows/auto-queue.yml:72 — The scheduled job expands the operational scope of MERGE_QUEUE_TOKEN from acting on a single event-triggered PR to iterating over all open PRs. This is acceptable for the use case but broadens the token's blast radius.

  • [quoting-convention] .github/workflows/auto-queue.yml:9 — Cron expression uses double quotes, while unit-tests.yml uses single quotes for its cron expression. Minor style inconsistency.

  • [missing-authorization] .github/workflows/auto-queue.yml — No linked issue for a non-trivial change that adds new scheduled CI infrastructure. The PR body provides clear rationale but lacks a formal tracking issue.


Labels: PR modifies GitHub Actions workflow file (.github/workflows/auto-queue.yml)


Next steps:

  • /fs-fix — agent addresses review findings automatically
  • /fs-fix <your instruction> — agent fixes with your specific guidance
  • Push commits directly — review re-runs automatically on push
  • /fs-fix-stop — disable automatic fix runs for this PR

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.


Note: The following inline comments could not be posted on the diff (GitHub returned 422) and are included here instead:

  • .github/workflows/auto-queue.yml:75: [medium] edge-case

gh pr list defaults to returning only 30 results. If the repository has more than 30 open PRs, eligible PRs beyond the first page will be silently skipped and never have auto-merge re-enabled.

Suggested fix: Add --limit 200 (or a suitably large number) to the gh pr list command.

  • .github/workflows/auto-queue.yml (file-level): Line 1 · [medium] permission-expansion

The workflow has no top-level permissions: block. Without explicit permission scoping, the workflow inherits the repository's default token permissions. Nearly every other workflow in this repository explicitly sets permissions. Adding a restrictive permissions block follows least-privilege and matches the repository convention.

Suggested fix: Add a top-level permissions: {} block to restrict the default GITHUB_TOKEN.

  • .github/workflows/auto-queue.yml:66: [low] logic-error

The requeue-eligible-prs job does not check whether the PR author is a repository collaborator before re-enabling auto-merge. The event-driven enable-auto-merge job gates on collaborator status, but the scheduled job bypasses this. The practical risk is low since the required labels are Prow-managed via OWNERS files.

  • .github/workflows/auto-queue.yml:75: [low] error-handling

The gh pr list ... | while read -r pr pipeline means failures from gh pr list are swallowed. The step exits 0 with no indication the scan never ran.

Suggested fix: Use set -euo pipefail or capture the output into a variable first.

  • .github/workflows/auto-queue.yml:72: [low] permission-expansion

The scheduled job expands the operational scope of MERGE_QUEUE_TOKEN from acting on a single event-triggered PR to iterating over all open PRs. This is acceptable for the use case but broadens the token's blast radius.

  • .github/workflows/auto-queue.yml:9: [low] quoting-convention

Cron expression uses double quotes, while unit-tests.yml uses single quotes for its cron expression. Minor style inconsistency.

Suggested fix: Change to single quotes for consistency: cron: '*/10 * * * *'

@fullsend-ai-review fullsend-ai-review Bot added the github_actions Pull requests that update GitHub Actions code label Aug 11, 2026
Addresses review feedback: gh pr list defaults to 30 results, silently
skipping eligible PRs. Also add set -euo pipefail and capture output
into a variable so API failures are not swallowed.

Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
Assisted-by: Claude Code <noreply@anthropic.com>
Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
@omer-vishlitzky
omer-vishlitzky merged commit 1ec4f25 into osac-project:main Aug 11, 2026
27 of 29 checks passed
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 11, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:20 PM UTC · Completed 11:34 PM UTC

Commit: 1cabc22 · View workflow run →

@fullsend-ai-review

Copy link
Copy Markdown

Review skipped — this PR is already merged.

The /fs-review command only reviews open pull requests.

Posted by fullsend pre-review check

@fullsend-ai-review

Copy link
Copy Markdown

Review skipped — this PR is already merged.

The /fs-review command only reviews open pull requests.

Posted by fullsend post-review check

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant