Only force merge-request flow when a direct push would be rejected - #10
Merged
Conversation
The protected-branch check forced the MR workflow whenever a branch was "protected", but that flag flips for rules that don't block a direct push (required status checks, signed commits, linear history, deletion protection), so releases were needlessly routed through an MR. Detect the real condition instead: - GitHub: query the branch rules for a `pull_request` rule (covers rulesets and classic protection, read access only) rather than `.protected`. - GitLab: check `.can_push` rather than `.protected`, so a maintainer pushing to a "Maintainers can push" branch still pushes directly.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The protected-branch check forced the merge-request workflow whenever a branch was protected — but that flag flips
truefor plenty of rules that don't block a direct push (required status checks, signed commits, linear history, deletion protection). So releases on those branches were needlessly routed through an MR.Confirmed against the live API:
vuejs/core'smainisprotected: truewith onlydeletion/non_fast_forwardrules — no PR requirement — yet was being forced to MR. GitLab had the same issue: it protects the default branch with "Maintainers can push" out of the box, soprotected: trueeven though the maintainer cutting the release can push directly.Fix
Detect the real condition — would this push actually be rejected? — per forge:
.protected(any rule)pull_requestrule present (rules endpoint).protected(any protection).can_push == falsepull_requestrule. Covers both rulesets and classic branch protection, and needs only read access (the branch-protection endpoint is admin-only)..can_push(whether the current user may push) instead of.protected, so a maintainer pushing to a "Maintainers can push" branch still pushes directly.Both undeterminable/CLI-missing fallbacks are unchanged — detection stays advisory and never blocks a release.
Tests
Unit tests updated for the new queries; full suite, typecheck, and lint pass.