From d4849bfe831c4ddd38bdf0abbae112d776bf4013 Mon Sep 17 00:00:00 2001 From: Tomas Maritano Date: Fri, 3 Jul 2026 10:52:18 -0300 Subject: [PATCH] ci: make owner auto-merge opt-in via `automerge` label MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Auto-merge was enabled on every owner PR on open/synchronize/ready, so PRs merged the moment branch protection was satisfied — before review was resolved — and stacked PRs targeting an unprotected feature branch merged instantly (this collapsed a stacked UI PR into its base). Now the owner job only enables auto-merge when the PR carries the `automerge` label (and reacts to the `labeled` event), so merging is an explicit opt-in. Dependabot auto-merge is unchanged. Requires an `automerge` label in the repo (create with `gh label create automerge`). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/automerge.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index a2db36b8..7b639567 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -2,18 +2,25 @@ name: Auto-merge on: pull_request: - types: [opened, synchronize, reopened, ready_for_review] + types: [opened, synchronize, reopened, ready_for_review, labeled] permissions: contents: write pull-requests: write jobs: + # Owner PRs are auto-merged ONLY when explicitly opted in with the `automerge` + # label. This prevents PRs from merging before review (e.g. before CodeRabbit + # comments are resolved) and prevents stacked PRs targeting an unprotected + # feature branch from merging the instant CI passes. Add the label when the PR + # is actually ready to merge; don't add it (or remove it) to hold. automerge-owner: runs-on: ubuntu-latest - if: github.event.pull_request.user.login == 'tomymaritano' + if: >- + github.event.pull_request.user.login == 'tomymaritano' && + contains(github.event.pull_request.labels.*.name, 'automerge') steps: - - name: Enable auto-merge for owner PRs + - name: Enable auto-merge for opted-in owner PRs env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PR_NUMBER: ${{ github.event.pull_request.number }}