From ca31829cb21fd2d79a883d3c6a098aec6de8ea16 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Thu, 7 May 2026 19:00:31 +0300 Subject: T8782: add central Mergify baseline for vyos org MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds `.mergify.yml` carrying the shared `commands_restrictions` block (9 keys: backport, copy, dequeue, queue, rebase, refresh, requeue, squash, update) and the `Label conflicting pull requests` rule. Per-repo files will reference this via `extends: mergify-config`. 🤖 Generated by [robots](https://vyos.io) --- .mergify.yml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .mergify.yml diff --git a/.mergify.yml b/.mergify.yml new file mode 100644 index 0000000..3557c80 --- /dev/null +++ b/.mergify.yml @@ -0,0 +1,42 @@ +# yaml-language-server: $schema=https://docs.mergify.com/configuration/file-format/ +# Central Mergify configuration for the `vyos` GitHub organization. +# +# This file lives at vyos/mergify-config:.mergify.yml and is referenced from +# every vyos//.mergify.yml via `extends: mergify-config`. +# +# Inheritance semantics (verbatim from docs.mergify.com/configuration/sharing): +# 1. "The configuration from the specified repository will be loaded and +# applied before the one in the current repository." — i.e., this file +# (the parent) loads first; the per-repo file (the child) is merged in +# afterwards and same-name rules in the child replace the parent's. +# 2. "Values in the `defaults` and `commands_restrictions` key will be +# merged and remote default values will apply to local configuration, +# unless a same default value already exist in the local configuration." +# 3. "Values in the `shared` key will not be merged and shared between +# local and remote configurations." — define YAML anchors locally only. + +pull_request_rules: + - name: Label conflicting pull requests + description: Add a label to a pull request with conflict to spot it easily + conditions: + - conflict + - '-closed' + actions: + label: + toggle: + - conflicts + +commands_restrictions: + backport: &allowed + conditions: + - or: + - sender=@vyos/maintainers + - sender=vyosbot + copy: *allowed + dequeue: *allowed + queue: *allowed + rebase: *allowed + refresh: *allowed + requeue: *allowed + squash: *allowed + update: *allowed -- cgit v1.2.3 From 31b3fc6e189dc96de1afcd2f474de63f414265d0 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 12 May 2026 09:29:41 +0300 Subject: T8782: set defaults.actions.backport.ignore_conflicts: false MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flip Mergify default from "commit conflict markers and open PR labeled `conflicts`" to "fail the backport, comment on source PR, create no destination PR." See in-file comment for the 2026-05-12 incident in vyos/vyos-documentation (#1994 → #1998/#1999 → conf.py markers merged → RTD `SyntaxError`) that drove this. Also fix stale `mergify-config` references in the header comment to match the repo rename (2026-05-09). This default is dormant for any repo until it adopts `extends: mergify` in its own `.mergify.yml`. The ~140 existing per-repo configs from T8531/T8615 are unaffected by this change. 🤖 Generated by [robots](https://vyos.io) --- .mergify.yml | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/.mergify.yml b/.mergify.yml index 3557c80..029faa6 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -1,8 +1,8 @@ # yaml-language-server: $schema=https://docs.mergify.com/configuration/file-format/ # Central Mergify configuration for the `vyos` GitHub organization. # -# This file lives at vyos/mergify-config:.mergify.yml and is referenced from -# every vyos//.mergify.yml via `extends: mergify-config`. +# This file lives at vyos/mergify:.mergify.yml and is referenced from +# every vyos//.mergify.yml via `extends: mergify`. # # Inheritance semantics (verbatim from docs.mergify.com/configuration/sharing): # 1. "The configuration from the specified repository will be loaded and @@ -15,6 +15,25 @@ # 3. "Values in the `shared` key will not be merged and shared between # local and remote configurations." — define YAML anchors locally only. +defaults: + actions: + backport: + # Fail the backport loudly on conflict instead of committing literal + # git conflict markers (<<<<<<< / ======= / >>>>>>>) into the destination + # branch and opening a PR labeled `conflicts`. With this set to false, + # Mergify posts an error comment on the source PR and creates no + # destination PR — the operator handles the conflict manually. + # + # Incident driving this default (2026-05-12): + # vyos/vyos-documentation#1994 was backported via `@Mergifyio backport + # sagitta circinus`. Cherry-pick conflicted in docs/conf.py; Mergify's + # default (ignore_conflicts: true) committed the markers, the resulting + # PRs (#1998, #1999) were merged anyway, and RTD builds on both branches + # failed with `SyntaxError: invalid syntax (conf.py)`. Fix-forwards + # #2000 (circinus) and #2001 (sagitta) removed the markers and + # re-applied the patch correctly. + ignore_conflicts: false + pull_request_rules: - name: Label conflicting pull requests description: Add a label to a pull request with conflict to spot it easily -- cgit v1.2.3 From d636ec0b1a696eafc9a8dc1ef6d3d2e193290a3c Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 12 May 2026 09:44:51 +0300 Subject: T8782: add PR title + commit message format rules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds two `pull_request_rules` that flag PRs whose title or commit message headlines do not match the required T-ID format: ^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.* Examples that pass: - `T99999: make IPsec secure` - `dhcpv6: T8849: Add time-zone support for Kea DHCPv6` Failing PRs get one of two labels: - `invalid-title` — PR title does not conform - `invalid-commit-title` — at least one commit's first line does not conform This replaces the reusable workflow at vyos/.github/.github/workflows/check-pr-message.yml and the per-repo caller workflows that invoke it. Coverage is dormant in any repo until it adopts `extends: mergify` in its own `.mergify.yml`; until then the existing GHA continues to run unchanged. Implementation notes: - Mergify exposes only `commits[*].commit_message` (full message, not headline-only), but default Python `re` flags make `^` = start-of- string and `.*` non-newline-matching, so `^` effectively checks the first line — equivalent to the GHA's `messageHeadline`. - Because `commits[*]` returns true on ANY-match and Mergify has no `!~=` operator, the commit-message rule uses a negative-lookahead regex that fires when at least one commit's first line does NOT conform. - Regex verified locally against representative valid samples (5 pass) and invalid samples (6 caught, including `Bump foo from 1.2.3 to 1.2.4` and `Merge pull request #...` — same behavior as the existing GHA, no regression). Migration sequence (out of scope for this commit): 1. This PR lands; rules dormant. 2. Per-repo PRs add `extends: mergify` (vyos-documentation PR #2005 is the first canary). 3. After parallel coverage confirms equivalence, retire per-repo check-pr-message.yml callers and the central reusable workflow in vyos/.github. 🤖 Generated by [robots](https://vyos.io) --- .mergify.yml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/.mergify.yml b/.mergify.yml index 029faa6..c92ed52 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -45,6 +45,55 @@ pull_request_rules: toggle: - conflicts + # ------------------------------------------------------------------ + # PR-message format rules — replaces vyos/.github:check-pr-message.yml + # + # Title and every commit's first line must follow: + # [optional `scope: ` prefix] T: + # Examples: + # T99999: make IPsec secure + # dhcpv6: T8849: Add time-zone support for Kea DHCPv6 + # + # The valid-form pattern: + # ^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.* + # + # Mergify exposes only `commit_message` (full message, not headline-only), + # but the default Python `re` flags make `^` = start-of-string and `.*` + # non-newline-matching, so `^` effectively checks the first line + # — equivalent to the original GHA's `messageHeadline` check. + # + # Because `commits[*]` returns true if ANY commit matches, and there is no + # `!~=` operator, the commit-message rule uses a negative-lookahead regex + # that matches when at least one commit's first line does NOT conform. + # ------------------------------------------------------------------ + + - name: Flag PR title not matching T-ID format + description: > + PR title must be `T: `, optionally prefixed with `scope: `. + Replaces the title half of vyos/.github:check-pr-message.yml. + conditions: + - '-closed' + - '-merged' + - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*' + actions: + label: + toggle: + - invalid-title + + - name: Flag commit message not matching T-ID format + description: > + Each commit's first line must match `T: `, optionally + prefixed with `scope: `. Replaces the commit-message half of + vyos/.github:check-pr-message.yml. + conditions: + - '-closed' + - '-merged' + - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*' + actions: + label: + toggle: + - invalid-commit-title + commands_restrictions: backport: &allowed conditions: -- cgit v1.2.3