OSAC-3734: add auto-queue workflow for merge queue

[omer-vishlitzky]

Summary

Automatically enables auto-merge on every non-draft PR from org members. When all required checks pass (E2E + label-gate), the PR enters the merge queue without any manual click — same UX as Tide.

How it works

1. PR opened (or marked ready for review) → workflow runs
2. Checks: not draft, author is org member/collaborator/owner
3. Runs gh pr merge --auto --rebase → enables auto-merge on the PR
4. Later, when E2E + label-gate all pass → PR auto-enters merge queue
5. Queue tests against latest main → merges

Security

• Uses pull_request_target so GITHUB_TOKEN has write permissions for fork PRs (all OSAC PRs come from forks)
• Safe: workflow never checks out or executes fork code — just calls gh pr merge --auto
• External contributors excluded via author_association check — they use manual "Add to merge queue" after ok-to-test

Part of OSAC-3734 (merge queue migration)

• osac#204 (merged) — label-gate.yml workflow
• This PR — auto-queue.yml workflow
• github-config#180 — enables merge queue
• OSAC-3734: osac-project: remove Tide merge queries, keep Prow plugins openshift/release#83121 — removes Tide merge queries

Test plan

• Non-draft PR from org member → auto-merge enabled
• Draft PR → skipped
• External contributor PR → skipped
• PR with auto-merge + all checks passing → enters merge queue automatically

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Streamlined the integration of completed changes by enabling eligible pull requests to be automatically queued for merging.
  • Improved consistency and efficiency in the change delivery process.

[openshift-ci-robot]

@omer-vishlitzky: This pull request references OSAC-3734 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Automatically enables auto-merge on every non-draft PR from org members. When all required checks pass (E2E + label-gate), the PR enters the merge queue without any manual click — same UX as Tide.

How it works

1. PR opened (or marked ready for review) → workflow runs
2. Checks: not draft, author is org member/collaborator/owner
3. Runs gh pr merge --auto --rebase → enables auto-merge on the PR
4. Later, when E2E + label-gate all pass → PR auto-enters merge queue
5. Queue tests against latest main → merges

Security

• Uses pull_request_target so GITHUB_TOKEN has write permissions for fork PRs (all OSAC PRs come from forks)
• Safe: workflow never checks out or executes fork code — just calls gh pr merge --auto
• External contributors excluded via author_association check — they use manual "Add to merge queue" after ok-to-test

Part of OSAC-3734 (merge queue migration)

• osac#204 (merged) — label-gate.yml workflow
• This PR — auto-queue.yml workflow
• github-config#180 — enables merge queue
• OSAC-3734: osac-project: remove Tide merge queries, keep Prow plugins openshift/release#83121 — removes Tide merge queries

Test plan

• Non-draft PR from org member → auto-merge enabled
• Draft PR → skipped
• External contributor PR → skipped
• PR with auto-merge + all checks passing → enters merge queue automatically

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: omer-vishlitzky

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [omer-vishlitzky]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Walkthrough

The pull request adds a GitHub Actions workflow for non-draft pull requests targeting main. The workflow enables automatic rebase merging for pull requests from members, collaborators, or owners.

Changes

Automatic pull request queueing

Layer / File(s)	Summary
Workflow eligibility and merge action .github/workflows/auto-queue.yml	The workflow handles qualifying pull request events, checks author association and draft status, grants required write permissions, and enables automatic rebase merging through the authenticated GitHub CLI.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the added auto-queue workflow and its purpose for the merge queue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	The only token reference is GH_TOKEN: ${{ github.token }}; the workflow contains no hardcoded key, password, private key, credential, or credential-bearing URL.
No-Weak-Crypto	✅ Passed	The PR adds only a GitHub Actions workflow that invokes gh pr merge --auto --rebase; the diff contains no weak crypto primitive, custom crypto, or secret comparison.
No-Injection-Vectors	✅ Passed	The workflow has one shell command, but its interpolated values are the numeric PR number and repository identifier; it uses no user-controlled free-form input or listed injection sink.
Container-Privileges	✅ Passed	The added workflow uses a standard ubuntu-latest runner and contains no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs	✅ Passed	The workflow passes GH_TOKEN to gh via the environment and logs no token, secret, password, PII, hostname, or customer data; its command uses only PR number and repository.
Ai-Attribution	✅ Passed	The PR identifies Claude Code and its sole commit includes an Assisted-by: Claude Code trailer; no Co-Authored-By trailer appears.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/auto-queue.yml:
- Around line 21-23: Update the workflow step invoking gh pr merge to
authenticate with a repository secret containing a GitHub App token or
fine-grained PAT authorized to merge and use the merge queue, replacing
github.token in GH_TOKEN while preserving the existing repository, pull-request
number, auto, and rebase arguments.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository: osac-project/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bad4c4cc-9424-4c9a-9bac-24477fe33bbe

📥 Commits

Reviewing files that changed from the base of the PR and between 4956560 and ea59541.

📒 Files selected for processing (1)

• .github/workflows/auto-queue.yml

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Use a merge-queue-capable credential.

GH_TOKEN receives the built-in GITHUB_TOKEN. GitHub documents that this token cannot add a pull request to a merge queue. Therefore, the command cannot meet this PR's merge-queue objective when main requires a merge queue. Use a GitHub App token or a fine-grained PAT with permission to merge, and store it as a secret. (docs.github.com)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-queue.yml around lines 21 - 23, Update the workflow
step invoking gh pr merge to authenticate with a repository secret containing a
GitHub App token or fine-grained PAT authorized to merge and use the merge
queue, replacing github.token in GH_TOKEN while preserving the existing
repository, pull-request number, auto, and rebase arguments.