mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

ci-queue-wait: no sanctioned merge path for a repository with no CI #1372

New Issue
Closed
opened 2026-08-23 17:27:11 +00:00 by code-be-01 · 0 comments
code-be-01 commented 2026-08-23 17:27:11 +00:00
Member
Copy Link
Copy Source

Defect

ci-queue-wait.sh --purpose merge exits 3 ASSERTED_NOT_READY state=no-status on any repository whose commits carry zero status contexts, and pr-merge.sh runs the guard with --purpose merge before every merge. A repository with no CI configured at all therefore has no wrapper merge path.

Push already has a queue-clear path for this case (a repo with no CI must remain pushable); merge deliberately stayed fail-closed there because at merge time no-status can also mean "CI has not reported yet". That leaves CI-less repos with approved PRs and no sanctioned merge, forcing the break-glass override for every such merge — which makes the override a gap, not an exception.

Fix direction

Add an explicit, audit-visible assertion: a --no-ci-expected flag on ci-queue-wait.sh that reclassifies the zero-context case for --purpose merge as queue-clear, with a printed line distinguishable from every other outcome (purpose, branch, asserting identity, reason). Without the flag, behavior is unchanged (merge on no-status still exits 3).

The assertion requires elevated identity: honored only when the acting token holds admin permission on the target repository. A non-admin caller gets a distinct refusal (own error text, exit code that is not 3) so the audit trail separates "asserted by a non-admin" from "CI late". pr-merge.sh gains a pass-through flag that forwards it to the guard call.

Acceptance criteria

  1. merge + no-status + flag + admin token -> exit 0 with the assertion audit line; a JSONL audit record is written.
  2. merge + no-status without the flag -> exit 3, existing error text unchanged.
  3. merge + no-status + flag + non-admin token -> distinct refusal, exit code not 3.
  4. flag + --require-status -> usage error.
  5. flag has no effect when any status context exists (pending still holds, failure still fails).
  6. push + no-status behavior unchanged.
  7. pr-merge.sh --no-ci-expected forwards the flag to the guard; absence does not.
  8. All existing test-ci-queue-wait-* and test-pr-merge-* suites still pass.
## Defect `ci-queue-wait.sh --purpose merge` exits 3 `ASSERTED_NOT_READY state=no-status` on any repository whose commits carry zero status contexts, and `pr-merge.sh` runs the guard with `--purpose merge` before every merge. A repository with no CI configured at all therefore has no wrapper merge path. Push already has a queue-clear path for this case (a repo with no CI must remain pushable); merge deliberately stayed fail-closed there because at merge time `no-status` can also mean "CI has not reported yet". That leaves CI-less repos with approved PRs and no sanctioned merge, forcing the break-glass override for every such merge — which makes the override a gap, not an exception. ## Fix direction Add an explicit, audit-visible assertion: a `--no-ci-expected` flag on `ci-queue-wait.sh` that reclassifies the zero-context case for `--purpose merge` as queue-clear, with a printed line distinguishable from every other outcome (purpose, branch, asserting identity, reason). Without the flag, behavior is unchanged (merge on no-status still exits 3). The assertion requires elevated identity: honored only when the acting token holds admin permission on the target repository. A non-admin caller gets a distinct refusal (own error text, exit code that is not 3) so the audit trail separates "asserted by a non-admin" from "CI late". `pr-merge.sh` gains a pass-through flag that forwards it to the guard call. ## Acceptance criteria 1. merge + no-status + flag + admin token -> exit 0 with the assertion audit line; a JSONL audit record is written. 2. merge + no-status without the flag -> exit 3, existing error text unchanged. 3. merge + no-status + flag + non-admin token -> distinct refusal, exit code not 3. 4. flag + `--require-status` -> usage error. 5. flag has no effect when any status context exists (pending still holds, failure still fails). 6. push + no-status behavior unchanged. 7. `pr-merge.sh --no-ci-expected` forwards the flag to the guard; absence does not. 8. All existing `test-ci-queue-wait-*` and `test-pr-merge-*` suites still pass.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1372