Skip to content

MERGIFY.md

Latest commit

 

History

History
129 lines (92 loc) · 5.14 KB

MERGIFY.md

File metadata and controls

129 lines (92 loc) · 5.14 KB
Raw

Mergify — CVE Radar

Merge queue, merge protections, stack labels, and Test Insights (JUnit from CI).

Item Location
Config .mergify.yml
Dashboard dashboard.mergify.com
Test Insights Mergify dashboard → CI → Test Insights
GitHub secret MERGIFY_TOKEN
JUnit upload ci-app.yml → mergifyio/gha-mergify-ci

One-time setup checklist

1. Install Mergify GitHub App

  1. Open Mergify dashboard and sign in with GitHub.
  2. Add organization/user RaminNietzsche and repository CVE-Radar.
  3. Confirm the Mergify GitHub App is installed on CVE-Radar with read/write on checks, PRs, and contents.

2. Enable Merge Protections

  1. Mergify dashboard → CVE-Radar → Merge Protections → Enable.
  2. Config in repo: .mergify.yml → merge_protections + merge_protections_settings.reporting_method: check-runs.
  3. GitHub → Settings → Branches (or Rulesets) → require check Mergify Merge Protections on main (optional, after first PR shows the check).

3. API token (Test Insights + CI upload)

  1. Mergify dashboard → Settings → API keys (or GitHub integration → API key).
  2. Create key with ci scope (name e.g. github-actions-cve-radar).
  3. GitHub secret:
gh secret set MERGIFY_TOKEN --repo RaminNietzsche/CVE-Radar

Verify:

gh secret list --repo RaminNietzsche/CVE-Radar | grep MERGIFY_TOKEN

4. Labels (automation)

Mergify rules use these labels (create any missing under Issues → Labels):

Label Purpose
automerge Queue PR for merge when protections pass
stack Mergify stack / dependent PRs
conflict Merge conflict (auto-toggled)
dependencies Dependabot PRs
no-automerge Block Dependabot auto-queue
size/XS … size/XL T-shirt size from diff stats 
gh label create automerge --repo RaminNietzsche/CVE-Radar --color 0E8A16 --description "Queue for merge when CI passes"
gh label create dependencies --repo RaminNietzsche/CVE-Radar --color 0366D6 --description "Dependabot PR"
gh label create no-automerge --repo RaminNietzsche/CVE-Radar --color B60205 --description "Do not auto-queue"

5. Verify Test Insights upload

Push a PR that runs CI / App or run:

gh workflow run ci-app.yml --repo RaminNietzsche/CVE-Radar

Then open Mergify → Test Insights — tests from junit.xml should appear.

CI integration

Workflow: CI / App — job App (lint · typecheck · build)

- run: npm run test:ci          # writes junit.xml + coverage/lcov.info
- uses: mergifyio/gha-mergify-ci@v19
  with:
    action: junit-process
    token: ${{ secrets.MERGIFY_TOKEN }}
    report_path: junit.xml
    test_step_outcome: ${{ steps.tests.outcome }}

Upload is best-effort (continue-on-error: true) so missing MERGIFY_TOKEN does not fail CI — but Test Insights stays empty until the token is set.

Merge queue (maintainers)

  1. Ensure Merge Protections and required CI checks are green.
  2. Add label automerge to the PR.
  3. Mergify auto-queues the PR when auto_merge_conditions match and every active merge protection passes, then squash-merges via queue rule default.

Manual queue: comment @mergifyio queue (does not require the automerge label).

Stack PRs: use mergify stack / branch prefix stack/ — auto-labeled stack.

How auto-merge works

Step Trigger
Label Maintainer (or Dependabot rule) adds automerge
Wait All path-gated merge protections pass → check Mergify Merge Protections turns green
Queue auto_merge_conditions in .mergify.yml adds PR to merge queue default
Merge Queue merge_conditions + GitHub ruleset required checks (branch protection injection)

Protections mirror branch ruleset checks: App, Codecov, SonarCloud, Trivy, CodeQL (×3), npm audit, docs — each gated by the same path filters as workflows.

Local parity

npm run test:ci    # produces junit.xml at repo root

Troubleshooting

Symptom Action
No Test Insights data Set MERGIFY_TOKEN; confirm CI / App ran and junit.xml exists.
Mergify Merge Protections failing Open check details; fix listed rule (often missing CI job for touched paths).
Stack PR not labeled Add label stack manually or use branch stack/* / Depends-On: / Change-Id: (see .mergify.yml).
Automerge not queueing Add label automerge, wait for Mergify Merge Protections + ruleset checks; resolve conflicts; enable Merge Protections in dashboard.
Dependabot not auto-queued Only patch/minor production deps without no-automerge; major updates need manual review.

Related