docs(rulesets): list required_deployments as an ignored ruleset rule

[sileht]

The Ruleset Rule Compatibility table put "Used by Merge Protections" in the required_deployments behavior column, directly under two rows reading "Injected as conditions". Readers compare the rows and conclude Mergify turns the rule into a merge condition, i.e. that it holds a pull request until the required deployment succeeds. It does not. The confusion is not hypothetical: a HackerOne reporter built an authorization-bypass report on that reading.

get_repository_rulesets_conditions() branches on required_status_checks and pull_request only. There is no required_deployments branch, so the rule is never injected, for the merge action or the merge queue.

The table has nothing to say about a rule Mergify does not inject, so the row goes and required_deployments joins the Ignored Rule Types list, which already says what a reader needs: "Mergify will not enforce them", "ensure they are enforced by GitHub directly on your target branch".

The intro made the same blanket claim one level up ("injects them as conditions"), now "injects the supported ones".

One caveat for the reviewer: the Ignored Rule Types section opens with "not processed by Mergify". That is true of the injection pipeline, which is what this page covers, but Mergify does read the rule elsewhere, in the Merge Protections healthcheck for reporting_method: deployments. If you would rather that nuance were visible, it belongs on the Merge Protections page, not here.

Adjacent PR: #12362 rewrites the bypass-mode guidance on this same file. It does not touch the table or the ignored list, and the two merge cleanly.

Fixes MRGFY-8644

[mergify]

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success = build
  • check-success = lint
  • check-success = test
  • any of:
    • check-success = test-broken-links
    • label = ignore-broken-links
  • any of:
    • check-success=Cloudflare Pages
    • -head-repo-full-name~=^Mergifyio/

🟢 👀 Review Requirements

• any of:
  • #approved-reviews-by >= 2
  • author = dependabot[bot]
  • all of:
    • author = mergify-ci-bot
    • -head ~= ^docs-agent/

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[Copilot]

Pull request overview

Clarifies the GitHub Rulesets compatibility documentation so readers don’t misinterpret required_deployments as a Mergify-injected merge condition, and instead understand that GitHub enforces it while Mergify only reads it for a specific Merge Protections configuration check.

Changes:

• Updates the required_deployments compatibility-table row to explicitly state it is not injected and is enforced by GitHub.
• Adds a new “Required Deployments” section explaining enforcement behavior and the one case where Mergify reads the rule.
• Tightens surrounding explanatory text to clarify that only “Injected as conditions” rows become Mergify conditions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sileht]

Revision history

#	Type	Changes	Reason	Date
1	initial	deb4a2f		2026-08-12 18:01 UTC
2	content	deb4a2f → 6e32f13		2026-08-12 18:01 UTC
3	content	6e32f13 → a5d30cf		2026-08-12 18:15 UTC
4	content	a5d30cf → 34020e1		2026-08-12 18:24 UTC

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-13 07:03 UTC · Rule: default · triggered by merge protections
• ✅ Checks passed · on draft merge queue: checking main (9126fe8) and #12367 together #12373
• ✅ Merged — 2026-08-13 07:07 UTC · at 34020e141c69c18acbb9bcd4b4163afec8b73811 · squash

This pull request spent 3 minutes 28 seconds in the queue, including 2 minutes 27 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub repository ruleset rule Require pull request for default branch]
  • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
• schedule=Mon-Fri 09:00-17:30[Europe/Paris]
• all of [🛡 Merge Protections rule Enforce conventional commit]:
  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:
    • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
• all of [🛡 Merge Protections rule 👀 Review Requirements]:
  • any of:
    • #approved-reviews-by >= 2
      • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
    • author = dependabot[bot]
      • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
    • all of:
      • author = mergify-ci-bot
        • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
      • -head ~= ^docs-agent/
        • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
• all of [🛡 Merge Protections rule 📕 PR description]:
  • body ~= (?ms:.{48,})
    • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
• all of [🛡 Merge Protections rule 🔎 Reviews]:
  • #changes-requested-reviews-by = 0
    • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
  • #review-requested = 0
    • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
  • #review-threads-unresolved = 0
    • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
• all of [🛡 Merge Protections rule 🤖 Continuous Integration]:
  • all of:
    • check-success = build
    • check-success = lint
    • check-success = test
    • any of:
      • check-success = test-broken-links
      • label = ignore-broken-links
        • docs(rulesets): list required_deployments as an ignored ruleset rule #12367
    • any of:
      • check-success=Cloudflare Pages
      • -head-repo-full-name~=^Mergifyio/
        • docs(rulesets): list required_deployments as an ignored ruleset rule #12367