devops: simplify PR completion and stabilize the merge queue

[gustavovalverde]

Parent

• Tracking: streamline Zebra's software delivery lifecycle #10962

What to build

Make review completion and queueing a single dependable path for routine changes. A maintainer who updates an approved PR must be able to inspect and approve the final diff, while unresolved review threads and explicit change requests remain blocking. Source-PR policy checks must evaluate contributor metadata, and queue candidates must validate only the combined tree that Mergify intends to merge.

Keep squash merging. Merge commits, as proposed in #10196, are outside this workstream.

This issue covers decisions 1 through 8 from the delivery-lifecycle review.

Acceptance criteria

• Disable the last-push approval restriction while retaining at least one human approval of the final diff.
• Preserve the unresolved-review-thread and change-request protections tracked by Pull requests with unresolved comments were merged #10034.
• Configure automated reviews to run on demand rather than on every PR update.
• Evaluate title, changelog, and other source metadata against the contributor's PR rather than Mergify-generated metadata.
• Cancel validation for queue candidates that Mergify closes or replaces.
• Re-evaluate and requeue an eligible source PR within 2 minutes after transient gates recover, unless it is draft, explicitly dequeued, marked do-not-merge, or has a change request.
• Set the routine queue wait to 2 minutes and use dynamic batches of 1 to 5 PRs.
• Store required check names in one version-controlled definition and audit GitHub rulesets and Mergify against it.
• Require Mergify for routine code changes, with explicit bot and emergency bypass policies.
• Run a focused queue-integration check in shadow mode for at least 1 work week and 20 queue candidates.
• Require queue-integration only after it catches every failure observed from the old queue suite and at least 95% of runs complete within 10 minutes.
• Keep full post-merge validation for 1 additional week before removing redundant queue or main checks.
• Ensure squash-merged commits use the approved PR title, addressing Commits in main inherit name of PR's last commit instead of PR title #10089.
• Record any GitHub settings changes and rollout evidence in this issue.

Related existing issues

• Pull requests with unresolved comments were merged #10034
• Commits in main inherit name of PR's last commit instead of PR title #10089
• Enable merge commits #10196 — related alternative, explicitly excluded
• devops: Update CODEOWNERS for DevOps review rotation #10139

Blocked by

None - can start immediately.

[gustavovalverde]

Repository settings

Effective settings for main:

• Pull requests require 1 approval, dismiss stale approvals after a changed diff, do not require approval from someone other than the last pusher, and require every review thread to be resolved.
• Explicit change requests remain blocking in GitHub and in Mergify's queue conditions.
• Squash is the only enabled and allowed merge method, and the squash commit title comes from the pull request title.
• GitHub and Mergify require the same 4 checks: lint, test-crates, unit-tests, and pr-gate-result.
• Automatic Copilot review is disabled. Maintainers can request Copilot review when it is useful.
• Eligible pull requests are routed through Mergify.

Remaining work:

• fix(ci): improve merge queue throughput #10969 changes the routine queue wait and batch size.
• fix(ci): skip source-only checks on queue candidates #10971 separates source-PR policy checks from queue-candidate checks.
• fix(ci): cancel closed merge queue runs #10972 cancels validation after Mergify closes a queue candidate.
• The required-check list still needs one version-controlled source that can audit the GitHub ruleset and Mergify configuration.
• Queue recovery and the evidence-based queue-integration shadow period remain pending.

[gustavovalverde]

Squash-only merge policy restored on 2026-07-17:

• Repository merge commits are disabled.
• The active PR Requirements ruleset allows only squash.
• PR ci: enforce squash merges in Mergify #11006 pins Mergify queues to merge_method: squash.