From 14bdffdcb33aea5bd04cedc3ec8a0e08ecba2368 Mon Sep 17 00:00:00 2001
From: Conduction Release Bot <release-bot@conduction.nl>
Date: Sun, 30 Aug 2026 10:01:24 +0200
Subject: [PATCH] fix(fleet): the Friday merge needs --admin, or it can merge
 almost nothing

The org ruleset "Development Branch Protection" carries a pull_request rule
with required_approving_review_count: 1, and its only bypass actor is
OrganizationAdmin. `gh pr merge --squash` without --admin is refused:

  Pull request #N is not mergeable: the base branch policy prohibits the
  merge.

Measured on run 33163749650 (schedule, 2026-08-28): of 49 candidates, 3
merged and 20 were refused by exactly this. Eighteen of the twenty were
`chore(release): *-unstable.*` version bumps, which were then superseded
and closed unmerged, so the work was not merely delayed - it was lost and
redone.

The run reported success and summarised "3 merged/would-merge, 46
skipped", which reads as a fleet with little ready to merge rather than a
merge step that could not act. Reproduced directly on buildiq#553: refused
without --admin, merged with it.

This does NOT weaken the gate. The same ruleset requires ZERO status
checks on development, so GitHub would merge a red pull request here. The
green rule this workflow enforces - every check reported, none failed,
and at least one present - is strictly stronger than the policy being
bypassed, and it is the only thing actually checking CI.

Verified: YAML parses, and bash -n on the run block extracted from the
parsed YAML.
---
 .github/workflows/fleet-friday-merge.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/fleet-friday-merge.yml b/.github/workflows/fleet-friday-merge.yml
index 02eb36e2..b7443883 100644
--- a/.github/workflows/fleet-friday-merge.yml
+++ b/.github/workflows/fleet-friday-merge.yml
@@ -172,7 +172,29 @@ jobs:
                 MERGED=$((MERGED + 1)); continue
               fi
 
-              if gh pr merge "${pr}" --repo "${R}" --squash 2>/dev/null; then
+              # --admin IS REQUIRED, and its absence is why this routine merged
+              # almost nothing. The org ruleset "Development Branch Protection"
+              # carries a `pull_request` rule with
+              # required_approving_review_count: 1, whose ONLY bypass actor is
+              # OrganizationAdmin. Without --admin the API refuses with:
+              #
+              #   Pull request #N is not mergeable: the base branch policy
+              #   prohibits the merge.
+              #
+              # MEASURED on run 33163749650 (schedule, 2026-08-28): of 49
+              # candidates, 3 merged and 20 were refused by exactly this — 18 of
+              # those being `chore(release): *-unstable.*` version bumps, which
+              # were then superseded and closed unmerged. The summary read
+              # "3 merged/would-merge, 46 skipped" and the run reported success,
+              # so it read as a fleet with little to merge rather than a merge
+              # step that could not act at all.
+              #
+              # This is NOT a weakening of the gate. That same ruleset requires
+              # ZERO status checks on `development`, so GitHub would happily
+              # merge a red pull request here. The green rule enforced above is
+              # strictly stronger than the policy being bypassed, and it is the
+              # only thing actually checking CI.
+              if gh pr merge "${pr}" --repo "${R}" --squash --admin 2>/dev/null; then
                 srow "| \`${app}\` | #${pr} | **merged** (${total} checks green) |"
                 MERGED=$((MERGED + 1))
               else