From 37aae6506cd8b5f027684fee1362860a6be0af44 Mon Sep 17 00:00:00 2001 From: coder-mos1 Date: Sat, 1 Aug 2026 00:35:13 -0500 Subject: [PATCH] fix(rm-03): remove merge queue-guard bypass --- packages/mosaic/framework/tools/git/pr-merge.sh | 12 ++---------- .../tools/git/test-pr-merge-gitea-empty-uid.sh | 12 ++++++++---- .../tools/git/test-pr-merge-head-pin.sh | 17 +++++++++++++++++ 3 files changed, 27 insertions(+), 14 deletions(-) diff --git a/packages/mosaic/framework/tools/git/pr-merge.sh b/packages/mosaic/framework/tools/git/pr-merge.sh index 4d3dc480..403ac056 100755 --- a/packages/mosaic/framework/tools/git/pr-merge.sh +++ b/packages/mosaic/framework/tools/git/pr-merge.sh @@ -1,6 +1,6 @@ #!/bin/bash # pr-merge.sh - Merge pull requests on Gitea or GitHub -# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] [--skip-queue-guard] +# Usage: pr-merge.sh -n PR_NUMBER [-m squash] [-d] set -euo pipefail @@ -12,7 +12,6 @@ source "$SCRIPT_DIR/detect-platform.sh" PR_NUMBER="" MERGE_METHOD="squash" DELETE_BRANCH=false -SKIP_QUEUE_GUARD=false DRY_RUN=false EXPECT_HEAD="" @@ -26,7 +25,6 @@ Options: -n, --number NUMBER PR number to merge (required) -m, --method METHOD Merge method: squash only (default: squash) -d, --delete-branch Delete the head branch after merge - --skip-queue-guard Skip CI queue guard wait before merge --dry-run Run metadata/login preflight without merging --expect-head SHA Refuse unless the PR head matches this full commit SHA -h, --help Show this help message @@ -35,7 +33,6 @@ Examples: $(basename "$0") -n 42 # Merge PR #42 $(basename "$0") -n 42 -m squash # Squash merge $(basename "$0") -n 42 -d # Squash merge and delete branch - $(basename "$0") -n 42 --skip-queue-guard # Skip queue guard wait EOF exit "${1:-1}" } @@ -55,13 +52,8 @@ while [[ $# -gt 0 ]]; do DELETE_BRANCH=true shift ;; - --skip-queue-guard) - SKIP_QUEUE_GUARD=true - shift - ;; --dry-run) DRY_RUN=true - SKIP_QUEUE_GUARD=true shift ;; --expect-head) @@ -116,7 +108,7 @@ if [[ -n "$EXPECT_HEAD" && "$HEAD_SHA" != "$EXPECT_HEAD" ]]; then exit 1 fi -if [[ "$SKIP_QUEUE_GUARD" != true ]]; then +if [[ "$DRY_RUN" != true ]]; then "$SCRIPT_DIR/ci-queue-wait.sh" \ --purpose merge \ -B "$HEAD_BRANCH" \ diff --git a/packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh b/packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh index acf50307..24d4d51e 100755 --- a/packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh +++ b/packages/mosaic/framework/tools/git/test-pr-merge-gitea-empty-uid.sh @@ -79,6 +79,10 @@ emit_response() { printf '200' fi } +if [[ "$args" == *"/api/v1/repos/mosaicstack/stack/commits/0123456789abcdef0123456789abcdef01234567/status"* ]]; then + emit_response '{"state":"success","statuses":[{"context":"ci/test","status":"success"}]}' + exit 0 +fi if [[ "$args" == *"/api/v1/repos/mosaicstack/stack/pulls/123"* && "$args" != *"/api/v1/repos/mosaicstack/stack/pulls/123/merge"* ]]; then emit_response '{"number":123,"title":"mock","state":"open","user":{"login":"tester"},"head":{"ref":"feature/mock","sha":"0123456789abcdef0123456789abcdef01234567","repo":{"full_name":"mosaicstack/stack"}},"base":{"ref":"main"},"labels":[],"assignees":[],"html_url":"https://git.mosaicstack.dev/mosaicstack/stack/pulls/123","mergeable":true}' exit 0 @@ -112,7 +116,7 @@ export GITEA_URL="https://git.mosaicstack.dev" export GITEA_TOKEN="redacted-test-token" OUTPUT="$SANDBOX/output.log" -if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then +if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash > "$OUTPUT" 2>&1; then echo "Expected pr-merge.sh to use the exact-head Gitea API path." >&2 echo "--- output ---" >&2 sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2 @@ -150,7 +154,7 @@ EOF chmod +x "$MOCK_BIN/tea" unset GITEA_LOGIN : > "$LOG_FILE" -if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then +if ! "$SCRIPT_DIR/pr-merge.sh" -n 123 -m squash > "$OUTPUT" 2>&1; then echo "Expected the exact-head API path not to depend on a tea login." >&2 sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2 sed 's/redacted-test-token/***REDACTED***/g' "$LOG_FILE" >&2 @@ -188,7 +192,7 @@ cd "$REPO_DIR" git remote set-url origin https://github.com/mosaicstack/stack.git : > "$LOG_FILE" rm -f "$SENTINEL" -if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then +if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash > "$OUTPUT" 2>&1; then echo "Expected GitHub metacharacter PR number to be rejected." >&2 sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2 exit 1 @@ -213,7 +217,7 @@ git remote set-url origin https://git.mosaicstack.dev/mosaicstack/stack.git export GITEA_LOGIN="git.mosaicstack.dev" : > "$LOG_FILE" rm -f "$SENTINEL" -if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash --skip-queue-guard > "$OUTPUT" 2>&1; then +if "$SCRIPT_DIR/pr-merge.sh" -n "$INJECTION" -m squash > "$OUTPUT" 2>&1; then echo "Expected Gitea metacharacter PR number to be rejected." >&2 sed 's/redacted-test-token/***REDACTED***/g' "$OUTPUT" >&2 exit 1 diff --git a/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh b/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh index 824cc1f4..0eec10f0 100644 --- a/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh +++ b/packages/mosaic/framework/tools/git/test-pr-merge-head-pin.sh @@ -118,6 +118,23 @@ if [[ "$bypass_rc" -eq 0 ]] || [[ -e "$WORK_DIR/gitea-payload-bypass.json" ]]; t exit 1 fi +# Dry-run is the only path that may omit the guard because it exits before the +# provider merge dispatch. Prove the exit and absence of a merge payload. +rm -f "$WORK_DIR/gitea-payload-dry-run.json" +( + cd "$WORK_DIR/gitea/repo" + export PATH="$WORK_DIR/gitea:$PATH" + export GITEA_TOKEN=stub-token + export GITEA_URL=https://git.example.test + export MOSAIC_CREDENTIALS_FILE="$WORK_DIR/no-credentials.json" + export MOSAIC_MERGE_PAYLOAD_LOG="$WORK_DIR/gitea-payload-dry-run.json" + env -u MOSAIC_GIT_IDENTITY "$WORK_DIR/gitea/tools/git/pr-merge.sh" -n 123 --dry-run +) >"$WORK_DIR/gitea-dry-run.out" 2>&1 +if [[ -e "$WORK_DIR/gitea-payload-dry-run.json" ]]; then + echo "FAIL dry-run: non-merging preflight reached the provider merge path" >&2 + exit 1 +fi + cat > "$WORK_DIR/github/gh" <<'SH' #!/usr/bin/env bash set -euo pipefail