OSAC-3734: add label-gate workflow for merge queue - #204
Conversation
Reads Prow-set labels (lgtm, approved, jira/valid-reference) and converts their presence to a status check the merge queue can gate on. Merge queue can only gate on status checks, not labels. Prow plugins set labels via OWNERS files — this workflow bridges the gap. Auto-passes on merge_group events since labels were already validated on the PR. Assisted-by: Claude Code <noreply@anthropic.com> Signed-off-by: omer-vishlitzky <omer.vishlitzky@gmail.com>
|
@omer-vishlitzky: This pull request references OSAC-3734 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: omer-vishlitzky The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
GitHub Actions
Error
GitHub Actions
Error
GitHub Actions
Error
WalkthroughThe new ChangesPull request label gate
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/label-gate.yml (2)
11-12: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winRestrict
merge_grouptochecks_requested.
merge_group:currently accepts all activity types. GitHub documentschecks_requestedas the supported activity and recommends an explicittypesfilter. If another activity is added later, the auto-pass step can report success without checking labels. (docs.github.com)Proposed trigger change
merge_group: + types: [checks_requested]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/label-gate.yml around lines 11 - 12, Update the merge_group workflow trigger to explicitly restrict its activity types to checks_requested, preserving the existing workflow behavior while preventing unsupported or future activities from invoking the auto-pass path.
20-24: 🔒 Security & Privacy | 🔵 TrivialVerify SAST and SCA coverage in the required PR pipeline.
This workflow only checks labels. It contains no SAST or SCA step. Confirm that another required workflow provides both checks for
main. If no such workflow exists, the PR pipeline lacks code and dependency security scanning.As per path instructions, include SAST/SCA steps in the pipeline.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/label-gate.yml around lines 20 - 24, Update the required PR workflow containing the “Check required Prow labels” step to include both SAST and SCA scanning steps, ensuring they run for pull requests targeting main. Reuse the repository’s established security scanning actions or commands, and preserve the existing label validation behavior.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/label-gate.yml:
- Around line 13-15: Add a pull-request-scoped concurrency block to the
check-labels job in label-gate.yml, using the pull request identifier as the
group and enabling cancel-in-progress. Update label evaluation to query the
current pull request labels rather than relying on
github.event.pull_request.labels, so out-of-order events use current state.
- Around line 4-5: Update the permissions configuration in the label-gate
workflow by removing the unused contents: read permission; either set contents
to none or omit the explicit permissions block, while preserving the workflow’s
existing event-data processing.
---
Nitpick comments:
In @.github/workflows/label-gate.yml:
- Around line 11-12: Update the merge_group workflow trigger to explicitly
restrict its activity types to checks_requested, preserving the existing
workflow behavior while preventing unsupported or future activities from
invoking the auto-pass path.
- Around line 20-24: Update the required PR workflow containing the “Check
required Prow labels” step to include both SAST and SCA scanning steps, ensuring
they run for pull requests targeting main. Reuse the repository’s established
security scanning actions or commands, and preserve the existing label
validation behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: ab356bf3-6b34-4257-9e2f-37b4689bd0ac
📒 Files selected for processing (1)
.github/workflows/label-gate.yml
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflow file:"
cat -n .github/workflows/label-gate.yml
echo
echo "Search for GitHub API usage / contents references in workflow:"
rg -n "contents|pulls/|issues/|repos/|api\.github\.com|curl|gh |jq|github\.event|uses:" .github/workflows/label-gate.yml || trueRepository: osac-project/osac
Length of output: 2067
Remove the unused contents: read permission.
This workflow only reads GitHub event data with github.event and jq; it does not checkout the repository or call the GitHub API. Set contents: none or omit the explicit permission block to keep GITHUB_TOKEN permissions minimal.
Proposed permission change
permissions:
- contents: read
+ contents: none📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| permissions: | |
| contents: none |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/label-gate.yml around lines 4 - 5, Update the permissions
configuration in the label-gate workflow by removing the unused contents: read
permission; either set contents to none or omit the explicit permissions block,
while preserving the workflow’s existing event-data processing.
Source: Path instructions
| jobs: | ||
| check-labels: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files matching label-gate:"
fd -a 'label-gate\.yml$|label-gate\.yaml$' .github/workflows || true
if [ -f .github/workflows/label-gate.yml ]; then
echo
echo "File outline/stat:"
wc -l .github/workflows/label-gate.yml
echo
echo "Workflow contents:"
cat -n .github/workflows/label-gate.yml
fi
echo
echo "All workflow labels and concurrency settings nearby:"
rg -n "label-gate|pull_request|pull_request_target|concurrency|labels|GITHUB_TOKEN|permissions:" .github/workflows || trueRepository: osac-project/osac
Length of output: 28462
Serialize label-gate runs per pull request.
.github/workflows/label-gate.yml triggers on multiple pull_request events and uses github.event.pull_request.labels without a concurrency group. Add a pull-request-scoped concurrency block with cancel-in-progress: true, and compare labels from a current PR query if label delivery can be out of order.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/label-gate.yml around lines 13 - 15, Add a
pull-request-scoped concurrency block to the check-labels job in label-gate.yml,
using the pull request identifier as the group and enabling cancel-in-progress.
Update label evaluation to query the current pull request labels rather than
relying on github.event.pull_request.labels, so out-of-order events use current
state.
2 participants
Summary
Adds two GitHub Actions workflows for the merge queue migration:
1.
label-gate.yml— bridge Prow labels to status checksMerge queue can only gate on status checks, not labels. Prow plugins set labels (
lgtm,approved,jira/valid-reference) via OWNERS files. This workflow reads those labels and reports a pass/fail status check that the merge queue can gate on.pull_requestlabel events (labeled,unlabeled,synchronize)merge_groupevents (labels were validated on the PR)lgtm→ label-gate re-triggers → fails until reviewer re-/lgtms2.
auto-queue.yml— automatic queue entry (same UX as Tide)Automatically enables auto-merge on every non-draft PR from org members. When all required checks pass (E2E + label-gate), the PR enters the merge queue without any manual click.
pull_request_targetso GITHUB_TOKEN has write permissions for fork PRs (all OSAC PRs come from forks)gh pr merge --autoauthor_associationcheck) — they use manual "Add to merge queue" afterok-to-testCompanion PRs — merge in this order
label-gate / check-labelsto required status checksTest plan
merge_groupeventslgtm, label-gate fails, reviewer must re-/lgtm🤖 Generated with Claude Code