From a99e39ee01b511253bf747fdf13fd3e5a44b5d95 Mon Sep 17 00:00:00 2001 From: Jim Meyer Date: Tue, 13 Oct 2026 17:09:58 +0000 Subject: [PATCH 1/2] fix(ci): skip maintainer approval in merge queue Signed-off-by: Jim Meyer --- .github/workflows/maintainer-approval.yml | 31 ++++++++++++++--------- 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/.github/workflows/maintainer-approval.yml b/.github/workflows/maintainer-approval.yml index f478ed97ac..1df2710fc2 100644 --- a/.github/workflows/maintainer-approval.yml +++ b/.github/workflows/maintainer-approval.yml @@ -22,7 +22,11 @@ jobs: # This name is the required status check context. Changing it silently # breaks the ruleset entry that gates merges on this job. name: OpenShell / Maintainer Approval - if: github.repository_owner == 'NVIDIA' + # Merge-group checks do not need to repeat the PR approval evaluation. + if: >- + github.repository_owner == 'NVIDIA' && + github.event_name != 'merge_group' && + github.event.pull_request.state == 'open' runs-on: ubuntu-latest timeout-minutes: 5 steps: @@ -45,21 +49,24 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GH_REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }} - # merge_group carries no pull request in its payload, but the queue - # branch names the entry: gh-readonly-queue/main/pr-3027-. - MERGE_GROUP_REF: ${{ github.ref_name }} shell: bash run: | set -euo pipefail - if [ -z "${PR_NUMBER:-}" ]; then - if [[ "$MERGE_GROUP_REF" =~ /pr-([0-9]+)-[0-9a-f]+$ ]]; then - PR_NUMBER="${BASH_REMATCH[1]}" - else - # Fail closed: an unrecognised ref must never satisfy the gate. - echo "::error::No pull request resolved from '$MERGE_GROUP_REF'." - exit 1 - fi + # Review events can arrive while queued or after the PR has closed. + # Query current state; API errors must fail rather than bypass approval. + should_check=$(gh api graphql \ + -F owner="${GH_REPO%%/*}" -F name="${GH_REPO#*/}" \ + -F number="$PR_NUMBER" \ + -f query='query($owner: String!, $name: String!, $number: Int!) { + repository(owner: $owner, name: $name) { + pullRequest(number: $number) { state mergeQueueEntry { id } } + } + }' \ + --jq '.data.repository.pullRequest | if . == null then error("Pull request not found") else (.state == "OPEN" and .mergeQueueEntry == null) end') + if [ "$should_check" = "false" ]; then + echo "Skipping maintainer approval: PR is queued or closed." + exit 0 fi gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/reviews" --jq '.[]' \ From 43e738e1b502dcfe8359aa988063b1cc59d4c7e6 Mon Sep 17 00:00:00 2001 From: Jim Meyer Date: Tue, 13 Oct 2026 18:25:29 +0000 Subject: [PATCH 2/2] refactor(ci): remove maintainer queue-state lookup Signed-off-by: Jim Meyer --- .github/workflows/maintainer-approval.yml | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/.github/workflows/maintainer-approval.yml b/.github/workflows/maintainer-approval.yml index 1df2710fc2..60d2cd7fc3 100644 --- a/.github/workflows/maintainer-approval.yml +++ b/.github/workflows/maintainer-approval.yml @@ -53,22 +53,6 @@ jobs: run: | set -euo pipefail - # Review events can arrive while queued or after the PR has closed. - # Query current state; API errors must fail rather than bypass approval. - should_check=$(gh api graphql \ - -F owner="${GH_REPO%%/*}" -F name="${GH_REPO#*/}" \ - -F number="$PR_NUMBER" \ - -f query='query($owner: String!, $name: String!, $number: Int!) { - repository(owner: $owner, name: $name) { - pullRequest(number: $number) { state mergeQueueEntry { id } } - } - }' \ - --jq '.data.repository.pullRequest | if . == null then error("Pull request not found") else (.state == "OPEN" and .mergeQueueEntry == null) end') - if [ "$should_check" = "false" ]; then - echo "Skipping maintainer approval: PR is queued or closed." - exit 0 - fi - gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/reviews" --jq '.[]' \ | jq -s '.' > reviews.json