mathias/gitea-mcp
1
0
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases Wiki Activity

feat(pr_merge): gate it like tbd_ship — green CI, unprotected base, exactly one risk/low issue (#74) #76

Merged
mathias merged 3 commits from wt/gate-pr-merge into main 2026-10-08 06:18:07 +00:00
Conversation 1 Commits 3 Files Changed 7
+529 -85
3 Commits
Author SHA1 Message Date
mathiasandClaude Sonnet 5.5 3955758c24 fix(merge gate): an unknown head commit never merges; pr_merge refuses closed and draft PRs (review of PR #76)
CD / Lint / Test / Vet (pull_request) Successful in 13s
Details
CD / Build & Import (pull_request) Skipped
Details
CD / Deploy via GitOps (pull_request) Skipped
Details 
Review found a bypass: a PR reporting an empty head sha made the runs query lose its head_sha filter (the repo's 50
most recent runs of any commit were classified) and dropped head_commit_id (omitempty), so the merge was unbound.
Both tools now go through evaluateMergeGate, which refuses without a head sha, and pollRuns makes no query without
one. pr_merge also reports merged:false for a PR that is not open or is a draft (Gitea refuses closed ones itself;
the gate no longer depends on that). Tests: unit (gate, counting-server pollRuns with positive control), end to end
for both tools, CI scoped to head_sha, closed/merged/draft. The two caller-wiring mutants are equivalent to the
pollRuns guard and survive by design.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM
 2026-10-08 08:15:49 +02:00
mathiasandClaude Sonnet 5.5 6efd309159 fix(merge gate): bind pr_merge and tbd_ship merges to the head commit the gate checked (TOCTOU)
CD / Lint / Test / Vet (pull_request) Successful in 12s
Details
CD / Build & Import (pull_request) Skipped
Details
CD / Deploy via GitOps (pull_request) Skipped
Details 
The gate evaluates CI for one head sha; a push to the PR branch between that check and the merge would have merged
unchecked code. MergePRArgs now carries head_commit_id (documented in Gitea 1.27.1's MergePullRequestOption) and both
tools send the sha they evaluated. Tests for both tools; each removal flip-tested red.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM
 2026-10-08 08:12:45 +02:00
mathiasandClaude Sonnet 5.5 c3d8401604 feat(pr_merge): gate it like tbd_ship — green CI, unprotected base, exactly one risk/low issue (gitea-mcp#74)
CD / Lint / Test / Vet (pull_request) Successful in 14s
Details
CD / Build & Import (pull_request) Skipped
Details
CD / Deploy via GitOps (pull_request) Skipped
Details 
pr_merge was an independent merge path with no CI, protection or tier check. It now reads the PR, the base's
branch protection and the head commit's CI runs, takes the tier from the issue named in `issue`, and runs the same
evaluateShipGate as tbd_ship (helpers shared, not copied). A refusal is a result (merged:false, reason, ci_status,
risk); an unreadable PR or protection probe is an error; a merge conflict is still an error. Above risk/low a human
merges in the UI. Tests: tier table, no-issue, issue lookup failures, CI and protection not overridden by risk/low,
read-side failures, tier read from the named issue only; nine wiring mutants flip-tested red. Shared reason text now
says "PR left open" (the PR already exists for pr_merge).

Behaviour change: pr_merge without `issue`, or on a PR with no green CI, merges nothing.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SZkhi49hfeSqBp5aZJNXsM
 2026-10-08 08:11:40 +02:00