.mergify.yml

# Every `check-success` name in this file must match a check name GitHub
# publishes on a pull request. That is not the same as a job `name:` in
# .github/workflows/, and comparing against the workflow source will mislead
# you: a matrix job's name is a template, so `Test (${{ matrix.os }})` is
# published as three separate checks, and `DCO` is a GitHub App that has no
# workflow at all.
#
# Nothing validates these names, and they have already drifted once: the
# conditions carried the Rust workspace's job names (quality, Build Binaries,
# Test Coverage, Tests (postgresql) and its siblings) after the Go rewrite
# renamed every job, so no pull request could satisfy them and no signal said
# why. A condition on a check that never reports does not fail, it waits.
#
# Renaming a CI job means editing this file in the same change, and editing
# every block that names it. The full CI list appears three times -- the
# dependabot and default queue rules, and the "Full CI must pass" protection
# -- while the dosubot and release-plz rules carry their own shorter lists.
# See docs/solutions/workflow-issues/mergify-conditions-named-retired-ci-jobs.md
# for the command that checks these names against a live pull request.
queue_rules:
    # Dosubot: only needs Lint (formatting + golangci-lint) to pass
  - name: dosubot
    merge_method: squash
    queue_conditions:
      - base = main
      - label != do-not-merge
      - author = dosubot[bot]
    merge_conditions:
      - check-success = Lint

    # Dependabot: full CI required
  - name: dependabot
    merge_method: squash
    queue_conditions:
      - base = main
      - label != do-not-merge
      - author = dependabot[bot]
    merge_conditions:
      - check-success = Lint
      - check-success = Build and vet
      - check-success = Test (ubuntu-latest)
      - check-success = Test (macos-latest)
      - check-success = Test (windows-latest)
      - check-success = Integration
      - check-success = Vulnerabilities
      - check-success = Coverage

    # Release-plz: DCO only (exempt from full CI -- code already tested on main)
  - name: release-plz
    merge_method: squash
    queue_conditions:
      - base = main
      - label != do-not-merge
      - author = release-plz[bot]
      - head ~= ^release-plz-
    merge_conditions:
      - check-success = DCO

    # Human PRs: manually enqueued via @mergifyio queue command
  - name: default
    merge_method: squash
    queue_conditions:
      - base = main
      - label != do-not-merge
      - author != dependabot[bot]
      - author != dosubot[bot]
      - -head ~= ^release-plz-
    merge_conditions:
      - check-success = Lint
      - check-success = Build and vet
      - check-success = Test (ubuntu-latest)
      - check-success = Test (macos-latest)
      - check-success = Test (windows-latest)
      - check-success = Integration
      - check-success = Vulnerabilities
      - check-success = Coverage

pull_request_rules:
  - name: Auto-approve dosubot PRs
    conditions:
      - base = main
      - author = dosubot[bot]
    actions:
      review:
        type: APPROVE
        message: Automatically approved by Mergify

  - name: Auto-approve dependabot PRs
    conditions:
      - base = main
      - author = dependabot[bot]
    actions:
      review:
        type: APPROVE
        message: Automatically approved by Mergify

  - name: Keep PRs up to date with main
    conditions:
      - base = main
      - -conflict
      - -draft
    actions:
      update: {}

merge_protections:
  - name: Enforce conventional commit
    description: >-
      Require conventional commit format per https://www.conventionalcommits.org/en/v1.0.0/.
      Skipped for bots.
    if:
      - base = main
      - author != dependabot[bot]
      - author != dosubot[bot]
      - -head ~= ^release-plz-
    success_conditions:
      - "title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\\(.+\\))?!?:"

  # The check names below are load-bearing and unvalidated. See the comment at
  # the top of this file; the dependabot and default queue rules carry this
  # same list.
  - name: Full CI must pass
    description: >-
      All CI checks must pass. Release-plz PRs are exempt because they only
      bump versions and changelogs (code was already tested on main), and
      GITHUB_TOKEN-triggered force-pushes suppress CI.
    if:
      - base = main
      - -head ~= ^release-plz-
    success_conditions:
      - check-success = Lint
      - check-success = Build and vet
      - check-success = Test (ubuntu-latest)
      - check-success = Test (macos-latest)
      - check-success = Test (windows-latest)
      - check-success = Integration
      - check-success = Vulnerabilities
      - check-success = Coverage

  - name: Do not merge outdated PRs
    description: Make sure PRs are within 10 commits of the base branch before merging
    if:
      - base = main
    success_conditions:
      - "#commits-behind <= 10"
merge_protections_settings:
  reporting_method: check-runs
# auto_merge_conditions reflects the queue_conditions of the queue rules that previously had autoqueue: true. The following queue rules were manual-only ('default') and remain reachable via the `/queue` command. Review and adjust if needed.
  auto_merge_conditions:
    - or:
        - and:
            - base = main
            - label != do-not-merge
            - author = dosubot[bot]
        - and:
            - base = main
            - label != do-not-merge
            - author = dependabot[bot]
        - and:
            - base = main
            - label != do-not-merge
            - author = release-plz[bot]
            - head ~= ^release-plz-