Skip to content

fix(yo61): enable auto-merge on reportlab-pdf, and record the missing approver - #71

Merged
robinbowes merged 2 commits into
mainfrom
fix/dependency-automerge-gap
Aug 15, 2026
Merged

fix(yo61): enable auto-merge on reportlab-pdf, and record the missing approver#71
robinbowes merged 2 commits into
mainfrom
fix/dependency-automerge-gap

Conversation

@robinbowes

Copy link
Copy Markdown
Contributor

What

Two changes from investigating why 26 green Dependabot PRs across yo61 are not merging.

data/yo61/claude-plugin-reportlab-pdf.yaml — add allow_auto_merge: true.

Decision 2026-08-03-plugin-repos-review-gated-automerge lists this repo under "Done (flag + in-code CI-gate)" and uses it as the template for the policy, but the flag was never encoded in its YAML, so it inherited the module default of false. It was the only repo in the policy set missing it — civi-mcp, claude-plugin-contributory-factors, claude-skills, gh-release-stats, go-udap, homebrew-tap, homelab-docs, jobhound, unifi-mcp and unifictl all set it.

Scoped plan:

~ allow_auto_merge = false -> true   # claude-plugin-reportlab-pdf
Plan: 0 to add, 1 to change, 0 to destroy.

CLAUDE.md — document a gap between this repo's policy and lastlight.

The policy sets default_branch_ruleset_required_approving_review_count: 1 and treats lastlight's approval as the "vetted" clause. lastlight does not approve pull requests: its dependabot-pr-merge workflow only enables auto-merge, its prompt states it "pre-empts no review", and the codebase exposes no approve capability. Green dependency PRs are therefore armed for auto-merge and one approval short indefinitely.

Observed 2026-08-15 across yo61: 26 open Dependabot PRs, all MERGEABLE with every check green, auto-merge armed on 21, reviews=0 on all 26.

The note also separates this from the stale-verdict failure in 2026-08-10-post-apply-pr-reevaluation — that one has an approval present and a cached blocker, and re-arming auto-merge clears it. This one has no approval, so re-arming does nothing.

Not in this PR

No decision file. Fixing the gap means either adding an approve step to lastlight or dropping the review count here and letting the no-bypass status-checks ruleset carry the gate alone. That choice is unmade.

Applying this does not merge anything: reportlab-pdf's four open Dependabot PRs are already armed but still unapproved.

robinbowes and others added 2 commits August 15, 2026 08:52
Decision 2026-08-03 lists this repo as fully wired for review-gated
auto-merge, but `allow_auto_merge` was never encoded, so it inherited the
module default of false. It was the only repo in the policy set missing the
flag.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The review-gated auto-merge policy treats lastlight's approval as the
"vetted" clause, but lastlight only enables auto-merge — it exposes no
approve capability. Green Dependabot PRs end up armed and one approval
short indefinitely.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

@yo61-lastlight yo61-lastlight Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR brings reportlab-pdf's declarative config back in line with the recorded auto-merge policy and documents the separate missing-approver gap. I found no blocking correctness issues in the Terraform/YAML change or the added policy note.

@robinbowes
robinbowes merged commit 79264ec into main Aug 15, 2026
2 checks passed
@robinbowes
robinbowes deleted the fix/dependency-automerge-gap branch August 15, 2026 07:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant