GeezerVison is showing github.com — Run CI on the merge queue and stop cancelling main push runs by mikolalysenko · Pull Request #1018 · SocketDev/socket-patch
Conversation
Problem
Main is red, and nothing stops it from turning red again.
- Main has no required status checks. The enterprise rulesets require a PR, one review, signed commits and the audit-GHA workflow, but no CI result. A PR can merge on a red or unfinished run.
- PRs that each pass on their own can break main once both merge. Fix scan/get --json dropping apply failures (#424) #955 and sbt, Mill and scala-cli support in agent, hosted and vendored modes #690 did exactly that: together they made three
PENDING_INLINE_DIGESTS entries stale, which fails test, test-release and coverage on every platform (the fix for that is Fix main CI red on stale digest pending-list entries #1016).
- Most main commits never get a CI result. All push runs share the
ci-refs/heads/main concurrency group, and a group keeps only one pending run, so during a merge burst every queued push run except the newest is cancelled. Of the last 60 main runs, 52 were cancelled. The comment above the group said push runs "always finish", which is wrong.
Change
ci.yml now also runs on merge_group (checks_requested). The merge-queue run gets the same pull_request-tier jobs; the nightly full tier stays skipped.- New
ci-ok job: if: always(), needs every job in the workflow, and fails if any of them failed or was cancelled. Skipped jobs pass. This gives the ruleset one check name to require.
- Push runs are grouped per commit (
github.sha), so none are cancelled. Merge-group refs are already unique per queue entry. PR runs still cancel their superseded runs.
- Corrected the concurrency and
hosted-e2e comments: no branch protection or ruleset lists hosted-e2e as a required check today.
After this merges (repo settings, not part of the diff)
Create a repository ruleset on main with:
- Merge queue: squash merges, build concurrency 5, group size 1–5, waiting for checks up to 60 min.
- Required status checks:
ci-ok, with strict mode off. The queue already tests each PR against the tip of main.
Open PRs pick up ci-ok the next time they are updated from main.
Testing
actionlint reports the same 63 warnings as on main (pre-existing matrix-property warnings) and nothing new.python3 -m pytest scripts/tests: 253 passed. The one failure is test_perf_harness busy-port, which depends on the local environment and is unrelated.
🤖 Generated with Claude Code
Note Medium Risk
Changes merge gating and CI concurrency behavior on main; misconfiguration of ci-ok or merge_group could block merges or let red builds through until rulesets are updated.
Overview
Enables merge-queue CI and a single required check so queued merges are gated on the same PR-tier jobs, while main push runs actually finish instead of being cancelled.
The workflow now triggers on merge_group (checks_requested) and adds a ci-ok job that always runs, depends on every other job, and fails if any needed job failed or was cancelled (skipped jobs count as pass). Nightly full jobs (e2e-full, yarn-berry-full, cargo-vex-matrix-full) stay skipped for both pull_request and merge_group.
Concurrency groups push runs per commit (github.sha) instead of a shared refs/heads/main key, so merge bursts no longer cancel most main CI runs; hosted-e2e uses the same per-SHA grouping on push. Comments are updated to reflect that merge blocking goes through ci-ok, not a directly required hosted-e2e check.
Reviewed by Cursor Bugbot for commit 323d329. Configure here.
Generated by Claude Code
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Add a merge_group trigger and a single aggregate `ci-ok` job that needs
every CI job, so a repository ruleset can require one check and turn on
GitHub's merge queue. The queue tests each PR merged onto the current tip
of main before it lands, which closes the semantic merge race that left
main red (two PRs that each passed on their own, #955 and #690, broke the
two-sided PENDING_INLINE_DIGESTS ratchet once both merged).
Group push runs per commit. A concurrency group keeps only one pending
run, so the shared refs/heads/main group cancelled every queued push but
the newest during a merge burst; most main commits never got a verdict.
The old comment claimed push runs "always finish", which was false.
Also correct the hosted-e2e comment: no branch protection or ruleset
registers it as a required check today; ci-ok needs it instead.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
![cursor[bot]](/api/image?u=https%3A%2F%2Favatars.githubusercontent.com%2Fin%2F1210556%3Fs%3D60%26v%3D4)
cursor
Bot
left a comment
•
edited
Loading
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.
Autofix Details
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Merge queue runs full-tier jobs
- Changed the condition in e2e-full, yarn-berry-full, and cargo-vex-matrix-full jobs to exclude both pull_request and merge_group events, preventing the nightly full matrices from running in the merge queue.
Or push these changes by commenting:
Preview (807b72adb8)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1699,7 +1699,7 @@
# v5 landings, the nightly schedule and dispatch run them with the `e2e`
# steps.
e2e-full:
- if: github.event_name != 'pull_request' || github.head_ref == 'release/v5-prerelease'
+ if: (github.event_name != 'pull_request' && github.event_name != 'merge_group') || github.head_ref == 'release/v5-prerelease'
needs: [test, coverage, e2e-build]
strategy:
fail-fast: false
@@ -1920,7 +1920,7 @@
# Skipped on pull_request (except v5 landings), like e2e-full.
yarn-berry-full:
name: yarn-berry ${{ matrix.yarn }} (${{ matrix.os }})
- if: github.event_name != 'pull_request' || github.head_ref == 'release/v5-prerelease'
+ if: (github.event_name != 'pull_request' && github.event_name != 'merge_group') || github.head_ref == 'release/v5-prerelease'
needs: [test, coverage]
strategy:
fail-fast: false
@@ -2012,7 +2012,7 @@
cargo-vex-matrix-full:
name: cargo ${{ matrix.toolchain }} lock-v${{ matrix.lock || 'own' }} (${{ matrix.os }})
- if: github.event_name != 'pull_request' || github.head_ref == 'release/v5-prerelease'
+ if: (github.event_name != 'pull_request' && github.event_name != 'merge_group') || github.head_ref == 'release/v5-prerelease'
needs: [test, coverage, e2e-build]
runs-on: ${{ matrix.os }}
timeout-minutes: 40You can send follow-ups to the cloud agent here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Oct 7, 2026
merge_group fell through the 'not pull_request' gate on e2e-full,
yarn-berry-full and cargo-vex-matrix-full, so every queue entry ran the
nightly matrices and could fail or overrun the queue wait. hosted-e2e
still grouped main pushes on github.ref; a group keeps one pending job,
so burst pushes cancelled each other and ci-ok counted that as failure.
Group main pushes per commit, matching the workflow-level group.
Co-Authored-By: Claude <[email protected]>
cursor[bot] reacted with thumbs up emoji
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 323d329. Configure here.
Sorry, something went wrong.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Oct 7, 2026
Uh oh!
There was an error while loading. Please reload this page.
Assignees
No one assigned
Milestone
No milestone
Development
Successfully merging this pull request may close these issues.
Uh oh!
There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
|