Skip to content

fix(impl-merge): add --admin to bypass missing required CI checks #5521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MarkusNeusinger merged 1 commit into from
Apr 29, 2026
Merged

fix(impl-merge): add --admin to bypass missing required CI checks #5521

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/impl-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,9 +191,16 @@ jobs:
gh pr update-branch "$PR_NUM" --repo "$REPOSITORY" 2>/dev/null || true
sleep 2

# --admin bypasses the branch ruleset's required-status-check
# gate. Required because impl-generate.yml pushes via GITHUB_TOKEN,
# which by GitHub's anti-recursion design does not trigger
# downstream CI workflows (Run Linting / Run Tests / Run Frontend
# Tests), so impl PRs never get those checks. The pipeline already
# gates merge behind the AI quality review threshold.
if gh pr merge "$PR_NUM" \
--repo "$REPOSITORY" \
--squash \
--admin \
Comment on lines +194 to +203
Copy link

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding --admin bypasses the branch ruleset’s required status checks, so this workflow can merge even when CI: Lint / CI: Tests / frontend checks would normally fail (not just when they are missing). If the intent is only to work around the GITHUB_TOKEN anti-recursion gap, consider triggering the required CI workflows via workflow_dispatch (or running lint/tests directly here) and only merging after they succeed, instead of bypassing them entirely.

Suggested change
# --admin bypasses the branch ruleset's required-status-check
# gate. Required because impl-generate.yml pushes via GITHUB_TOKEN,
# which by GitHub's anti-recursion design does not trigger
# downstream CI workflows (Run Linting / Run Tests / Run Frontend
# Tests), so impl PRs never get those checks. The pipeline already
# gates merge behind the AI quality review threshold.
if gh pr merge "$PR_NUM" \
--repo "$REPOSITORY" \
--squash \
--admin \
# Do not bypass branch protection rules. Only merge when the PR's
# checks are successful so required status checks remain enforced.
if ! gh pr checks "$PR_NUM" --repo "$REPOSITORY"; then
echo "::warning::Required PR checks are not passing yet; merge will be retried."
elif gh pr merge "$PR_NUM" \
--repo "$REPOSITORY" \
--squash \

Copilot uses AI. Check for mistakes.
--delete-branch; then
Comment on lines 200 to 204
Copy link

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gh pr merge --admin only works when the authenticated actor has admin/bypass privileges for the repo ruleset. This workflow authenticates with secrets.GITHUB_TOKEN; unless the repo is configured to allow GitHub Actions to bypass protections (or the token represents an admin), merges may still fail repeatedly. Consider adding an explicit preflight check / clearer failure message when bypass permission is not available, or switching to a token with the needed privileges.

Copilot uses AI. Check for mistakes.
echo "::notice::Merge successful on attempt $attempt"
exit 0
Expand Down
Loading