Repository navigation
feat: support the merge_group event for merge queue checks - #1
Closed
imichaelmoore wants to merge 4 commits into
Closed
imichaelmoore wants to merge 4 commits into
imichaelmoore wants to merge 4 commits into
Conversation
Workflows triggered by a merge queue failed with "Unsupported event type: merge_group". The event now runs in agent mode like the other automation events. - GitHub reports these runs as github-merge-queue[bot]; the human-actor check accepts that actor for merge_group without an allowed_bots entry. - The merge group commit carries the queued pull requests' changes, so Claude's config paths are restored from the target branch, as on PRs. The choice of restore branch moves into a tested resolveRestoreBase(). - Adds docs, an example merge queue check, and a project verify skill.
The example now passes the workflow token, so a queued PR that edits the workflow is no longer skipped by the App token exchange, and Claude stays within the job's read-only permissions. It reviews a diff written before the action runs, taken against the target branch so entries ahead in the queue are covered, and it no longer allows Bash. - security.md lists the merge queue app under Bot User Control and covers merge_group alongside pull_request_target and workflow_run. - The base ref test now proves validation runs after refs/heads/ is stripped. - Drops the local verify skill, which is unrelated to this change.
The example wrote its diff with settings taken from the checkout, which is the queued pull requests' own content. - A .gitattributes entry marking a file -diff or binary reduced it to "Binary files differ", hiding its content from the review. Attributes now come from the target branch via --attr-source, and the prompt asks Claude to open any binary file that looks like it should be text. - `ignore = all` in .gitmodules hid submodule pointer changes, so the diff passes --ignore-submodules=none. - A committed merge-group.diff symlink redirected the write. The path is removed first. - Quoting the reason on one line stopped `::` workflow commands but not the legacy `##[` form, which the runner matches anywhere in a line. Commands are now stopped with a random token while the reason prints.
- security.md listed merge_group under checkout guidance that is wrong for it: with no `ref:` the checkout is the merge group, not the base branch. It now has its own section, which says what the example relies on, that the hook caveat applies to merge groups too, and how to use the subdirectory pattern for stricter separation. The original heading and its anchor are restored. - The docs no longer claim every merge_group run is attributed to the merge queue app, and say what happens for any other actor. - The allowed_bots descriptions said the default allows no bots. They now say the merge queue app is accepted on merge_group events without an entry. The longer cell re-pads the inputs table in usage.md. - The example job sets timeout-minutes so a stalled run cannot hold up the queue.
Owner
Author
|
Closing in favor of anthropics#1894, which was opened from this same branch against the upstream repository. The red checks here are the integration workflows that call Claude (test-base-action, test-settings, test-structured-output, test-mcp-servers, test-custom-executables). Each one stops with "Either ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, or workload identity federation ... is required", because this fork has no Anthropic secret configured. The same jobs fail the same way on #2, which changes unrelated code, so the failures come from the fork's setup rather than from this branch. Unit tests, typecheck, prettier and the workflow security check all pass on 544fadf. Generated by Claude Code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Human: @imichaelmoore
Requested by Michael · project thread
Before: a workflow triggered by a merge queue (
on: merge_group) failed immediately with "Unsupported event type: merge_group".After:
merge_groupruns in agent mode with aprompt, likeworkflow_dispatchandschedule, so the action can serve as a merge queue check.How
github-merge-queue[bot]. The human-actor check accepts exactly that actor for this event, so noallowed_botsentry is needed; other bots on merge_group are still rejected..claude/,.mcp.json,CLAUDE.mdand the other sensitive paths are restored from the target branch before the CLI starts, the same protection pull requests get. Choosing the restore branch moved fromrun.tsinto a testedresolveRestoreBase(); pull request behavior is unchanged.track_progressis rejected for merge_group, as for the other automation events.examples/merge-queue-check.yml(fails the check when Claude finds a blocker), and a.claude/skills/verifyrecipe for drivingrun.tslocally.Test plan
bun run typecheckandbun test(984 pass). Drovesrc/entrypoints/run.tswith a simulated merge_group payload against a temp repo and local origin: on main it fails with "Unsupported event type: merge_group"; on this branch it reaches the CLI with the target branch's config restored and the queued versions in.claude-pr/. Probes held: another bot actor is not exempt,track_progresserrors, an invalidbase_refis rejected, a shallow checkout still restores.Not verified: a live merge queue run, or the GitHub App token exchange for this event (the
github_tokeninput bypasses it).Generated by Claude Code