fix(docs): simplify ruleset bypass guidance to one recommendation - #12362
Conversation
|
This pull request is part of a Mergify stack:
|
Merge Protections🟢 All 6 merge protections satisfied — ready to merge. Show 6 satisfied protections🟢 🤖 Continuous Integration
🟢 👀 Review Requirements
🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 🔎 Reviews
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
6525eed to
a1c8491
Compare
e02a01c to
437c891
Compare
Revision history
|
There was a problem hiding this comment.
Pull request overview
This PR updates the GitHub Rulesets Compatibility documentation to reflect how Mergify behaves with GitHub ruleset bypass modes, especially for GitHub-native stacked pull requests that merge via GitHub’s stack merge API.
Changes:
- Rewrites the “Bypass Actors and Injection” guidance to recommend
exemptand clarify how bypass mode relates to rule injection. - Adds a new “Known Incompatibilities” entry explaining why stacked PR merges require
exempton applicable rulesets. - Updates the “Configuring Mergify as a Bypass Actor” steps to align with the revised recommendation and cross-link the rationale.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
a1c8491 to
c8cec50
Compare
c8cec50 to
0714c93
Compare
0714c93 to
7f215a4
Compare
7f215a4 to
83b0f8d
Compare
83b0f8d to
f0af7cd
Compare
|
Removed that clause, and took the simplification further across the page per your steer — the reader should not need to know how the system works, only what to set.
Two consequences worth knowing:
|
The page explained how the three bypass modes interact with condition injection, which a reader does not need in order to configure Mergify. It also got that explanation wrong: it claimed `exempt` makes Mergify skip injection, which is no longer what the engine does. Say what to configure instead: add Mergify as a bypass actor and set the mode to `exempt`, everywhere the page used to recommend `always`. That also covers GitHub-native stacked pull requests, which need `exempt` specifically, so one recommendation now fits every case. Rename the section to "Bypass Actors" now that it no longer covers injection, and point it at the step-by-step section further down. Part of MRGFY-8578 Change-Id: Iafcbdb198dc7d2d8a8f27ac0ff7f4b7867b405a7
f0af7cd to
fd6c677
Compare
…12367) The Ruleset Rule Compatibility table put "Used by Merge Protections" in the `required_deployments` behavior column, directly under two rows reading "Injected as conditions". Readers compare the rows and conclude Mergify turns the rule into a merge condition, i.e. that it holds a pull request until the required deployment succeeds. It does not. The confusion is not hypothetical: a HackerOne reporter built an authorization-bypass report on that reading. `get_repository_rulesets_conditions()` branches on `required_status_checks` and `pull_request` only. There is no `required_deployments` branch, so the rule is never injected, for the merge action or the merge queue. The table has nothing to say about a rule Mergify does not inject, so the row goes and `required_deployments` joins the Ignored Rule Types list, which already says what a reader needs: "Mergify will not enforce them", "ensure they are enforced by GitHub directly on your target branch". The intro made the same blanket claim one level up ("injects them as conditions"), now "injects the supported ones". One caveat for the reviewer: the Ignored Rule Types section opens with "not processed by Mergify". That is true of the injection pipeline, which is what this page covers, but Mergify does read the rule elsewhere, in the Merge Protections healthcheck for `reporting_method: deployments`. If you would rather that nuance were visible, it belongs on the Merge Protections page, not here. Adjacent PR: #12362 rewrites the bypass-mode guidance on this same file. It does not touch the table or the ignored list, and the two merge cleanly. Fixes MRGFY-8644
|
Queued — the merge queue status continues in this comment ↓. |
|
@Mergifyio queue |
🛑 The pull request cannot be checked because of an incompatibility with branch protectionsDetailsMergify's bypass mode is not |
Merge Queue Status
This pull request spent 4 minutes 51 seconds in the queue, including 3 minutes 19 seconds running CI. Required conditions to merge
|
The page explained how the three bypass modes interact with condition
injection, which a reader does not need in order to configure Mergify. It
also got that explanation wrong: it claimed
exemptmakes Mergify skipinjection, which is no longer what the engine does.
Say what to configure instead: add Mergify as a bypass actor and set the mode
to
exempt, everywhere the page used to recommendalways. That also coversGitHub-native stacked pull requests, which need
exemptspecifically, so onerecommendation now fits every case.
Rename the section to "Bypass Actors" now that it no longer covers injection,
and point it at the step-by-step section further down.
Part of MRGFY-8578