Skip to content

chore(gitar): merge commits only; never arm auto-merge on owner-seal holds - #3648

Merged
BigSimmo merged 6 commits into
mainfrom
chore/gitar-merge-criteria-20261018
Oct 18, 2026
Merged

BigSimmo merged 6 commits into
mainfrom
chore/gitar-merge-criteria-20261018

Conversation

@BigSimmo

@BigSimmo BigSimmo commented Oct 18, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • Adds .gitar/config/merge.md, the per-repository auto-merge criteria Gitar reads from the default branch (added to, never replacing, the organisation criteria).
  • Tells Gitar to use merge commits only (squash and rebase merging are disabled since 2026-10-18).
  • Tells Gitar not to arm auto-merge when an owner-seal hold note is present (e.g. Fix confirmed merged-PR review findings and stage atomic milestone repair #3638, fix: remediate full-deep audit findings and retain release holds #3640). Migration PRs (supabase/migrations/**) may still be armed once required checks pass, per the standing rule, but only when no owner-seal hold note is present.
  • Places .gitar/** in the Delivery and assurance area (docs/organisation/systems/delivery.json) so the organisation check stays clean.
  • Lists .gitar/ in docs/codebase-index.md (both root maps) so the codebase-index coverage check passes.

Areas touched: Delivery and assurance, Knowledge and records

Verification

  • Checks run: npm run check:organisation → "organisation: exit 0 (pass) … 0 not yet placed, 0 unplaced"; npm run check:instructions → "instruction-budget: pass"; npm run check:rule-consistency → "rule-consistency: pass — 22 active source(s), 0 problem(s)"; npm run docs:check-links → "docs link check passed: 5972 repo path references resolve." node scripts/check-codebase-index-coverage.mjs → "coverage OK: all 111 repository roots/modules/routes … are indexed"; npm run check:repo-awareness-snapshot → "in step"; npm run docs:check-scripts and npm run check:decisions pass.

Risk and rollout

  • Risk: Low. Config text for an external reviewer bot; no executable code. Note the merge method Gitar uses is chosen in the Gitar dashboard (Settings → Configuration → Behavior → Auto-merge PRs); this file states the intent and controls when Gitar arms auto-merge.
  • Rollback: Revert this merge commit.
  • Provider or production effects: None

Notes

  • Gitar reads this file from main, so it takes effect only after merge.

@BigSimmo
BigSimmo enabled auto-merge October 18, 2026 10:01

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BigSimmo has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 18, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-18T10:03:48.548999Z b0241e5 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Next included review available in 8 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 124 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration
  • Configuration used: Repository: BigSimmo/PsychSift/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Team
  • Run ID: 708048b4-9600-4635-b62d-0deda6d0999f
📥 Commits

Reviewing files that changed from the base of the PR and between 6d6a225 and 5a2f144.

📒 Files selected for processing: 3
  • .gitar/config/merge.md
  • docs/codebase-index.md
  • docs/organisation/systems/delivery.json
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

@claude

claude Bot commented Oct 18, 2026 •

Copy link
Copy Markdown
Contributor

Claude encountered an error after 2s —— View job


I'll analyze this and get back to you.

@supabase

supabase Bot commented Oct 18, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

Comment thread .gitar/config/merge.md Resolved
gitar-bot[bot]
gitar-bot Bot previously approved these changes Oct 18, 2026

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitar has auto-approved this PR (configure)

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b0241e59c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread .gitar/config/merge.md Resolved
@cubic-dev-ai

cubic-dev-ai Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor

Auto-fix isn't included in your plan ↗

Upgrade to Team

gitar-bot[bot]
gitar-bot Bot previously approved these changes Oct 18, 2026

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitar has auto-approved this PR (configure)

@gitar-bot gitar-bot Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gitar has auto-approved this PR (configure)

@gitar-bot

gitar-bot Bot commented Oct 18, 2026

Copy link
Copy Markdown
Contributor
Code Review ✅ Approved 1 closed / 1 findings

🔴 High risk · The new Gitar criteria govern auto-merge authorization for migration PRs; misreading an owner-seal hold could arm an unapproved database change.

Adds .gitar/config/merge.md so Gitar uses merge commits only and never arms auto-merge when an owner-seal hold note is present, with .gitar/** placed in the Delivery and assurance area and listed in docs/codebase-index.md. The previously open finding that the owner-owned auto-merge rule omitted the 'do not disable' half was addressed. No open issues remain.

✅ 1 closed
✅ Quality: Owner-owned auto-merge rule omits 'do not disable' half

📄 .gitar/config/merge.md:16-17
Line 16-17 tells Gitar only that it must not turn auto-merge back on after it was turned off. The governing rule (publication-workflows / §10) says automation must neither disable nor re-enable auto-merge once the user owns it. As written, Gitar could still turn off armed auto-merge on a PR, for example after it finds an issue or sees a hold-like phrase. That would quietly change a state the owner controls. Fix this by stating both directions, and say that a newly seen hold note is to be reported, not acted on by disarming.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Approved

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact
gitar auto-apply:on         
gitar display:verbose         

Important

Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

Was this helpful? React with 👍 / 👎 | Gitar

@BigSimmo
BigSimmo merged commit 986f3e8 into main Oct 18, 2026
30 checks passed
@BigSimmo
BigSimmo deleted the chore/gitar-merge-criteria-20261018 branch October 18, 2026 10:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant