Skip to content

add conflict action, remove check temp due not using main branch #1859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
acosferreira merged 1 commit into from
Feb 11, 2026
+16 −4
Merged

add conflict action, remove check temp due not using main branch #1859

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions .github/mergify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ pull_request_rules:
- author=dependabot[bot]
- label=security
- label=python
- check-success=pre-commit
- check-success=selftest # pip_compile check
# - check-success=pre-commit
# - check-success=selftest # pip_compile check
Copy link

@cursor cursor bot Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI checks disabled for Dependabot auto-approval rules

Medium Severity

The check-success=pre-commit and check-success=selftest conditions are commented out in both the Python security updates and non-security Dependabot auto-approval rules. The PR title describes this as "temp," but it's being committed to the repo. This means Dependabot PRs for Python will be auto-approved without any CI checks passing, weakening the safety gate other ecosystems (Admin Portal, Chatbot, GitHub Actions) still enforce.

Additional Locations (1)

Fix in Cursor Fix in Web

- "#changes-requested-reviews-by=0"
- "#review-requested=0"
actions:
Expand Down Expand Up @@ -73,11 +73,23 @@ pull_request_rules:
conditions:
- author=dependabot[bot]
- -label=security
- check-success=pre-commit
- check-success=selftest
# - check-success=pre-commit
# - check-success=selftest
- "#changes-requested-reviews-by=0"
- "#review-requested=0"
actions:
review:
type: APPROVE
message: "Dependabot PR auto-approved. Manual merge required for non-security updates."

# Detect when PR conflicts and add label
- name: warn on conflicts
conditions:
- conflict
actions:
comment:
message: "This pull request is now in conflicts. Could you fix it @{{author}}?
🙏"
label:
add:
- conflict
Copy link

@cursor cursor bot Feb 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing rule to remove conflict label after resolution

Medium Severity

The new "warn on conflicts" rule adds a conflict label when a PR has merge conflicts, but there's no companion rule to remove the label once the conflict is resolved. Mergify only triggers actions when conditions match — once the conflict is gone, the - conflict condition is no longer true, so the rule simply stops matching without undoing its previous actions. The conflict label will persist on resolved PRs indefinitely, making it misleading.

Fix in Cursor Fix in Web

Loading