Skip to content

ci(tooling): mergeStateStatus reads BLOCKED on mergeable PRs — bypass actors are not accounted for #15367

Description

@mrveiss

Parent: #15357

Problem

mergeStateStatus: BLOCKED and reviewDecision: REVIEW_REQUIRED are false signals on this
repository, and they cost real diagnosis time.

The Dev_new_gui ruleset requires 1 approving review but grants
RepositoryRole 5 (admin) bypass_mode: always. GitHub computes mergeStateStatus without
accounting for bypass actors, so a PR that the owner can merge right now still reports BLOCKED.
Proof: #15351, #15349 and #15342 all merged with zero approving reviews.

Consequence: every consumer of mergeStateStatus — the drain script, review-queue tooling,
any agent running the "sweep PRs → review → merge" loop — reads a queue of 5 mergeable PRs as a
jammed queue and goes looking for a blocker that does not exist. This happened during the triage
of #15357 itself.

Fix

Establish one repo-local helper that answers "can this PR actually land?" and have every consumer
use it instead of reading mergeStateStatus directly. It must account for:

  • bypass actors on the applicable rulesets vs. the acting account's role,
  • required status check conclusions (the part that is trustworthy),
  • genuine DIRTY / conflict states.

Audit and convert existing call sites — the drain/readiness script and any workflow or skill that
branches on mergeStateStatus or reviewDecision.

Acceptance Criteria

  • One helper is the single source for PR landability; documented where the other CI docs live
  • All call sites reading mergeStateStatus/reviewDecision for a landability decision converted
  • On the current 5 open PRs the helper reports "landable", matching reality
  • A PR with a genuinely failing required check still reports "not landable"

Implementation Order

Wave: 1
Depends on: none
Unblocks: #15357

Activity

  1. mrveiss commented on Aug 31, 2026

    @mrveiss
    OwnerAuthor

    Correction — there is no repo-side code to fix here

    Grepped the repository for consumers of mergeStateStatus / reviewDecision. Two files match,
    and both matches are comments, not code:

    • auto-update-pr-branches.yml:166 — # #12818: do NOT filter on mergeStateStatus. It is computed LAZILY by [GitHub] — an explicit warning against the exact misuse this issue describes. The
      workflow already avoids it.
    • frontend-required-context.yml:23 — a comment recording a past incident where
      mergeStateStatus read BLOCKED with no failing job.

    So the repo already knows this trap and has written it down twice. The consumers that actually
    misread landability are outside this repository (the local drain-parked.sh readiness script,
    and agent reasoning), which no PR here can reach.

    Closing as not-actionable in this repo. The underlying observation stands and is recorded on
    #15357 — mergeStateStatus: BLOCKED is cosmetic here because the ruleset grants the admin role
    bypass_mode: always, and GitHub computes that field without accounting for bypass actors — but
    the fix belongs in the local tooling, not in a tracked file.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions