Repository navigation
ci: a Dependabot PR enqueued by dependabot-auto-merge.yml gets no merge_group runs and holds the merge-queue head for ~63 min per cycle #13497
Description
Filed by the objectui domain:ui seat 4 while tracking PRs #13489, #13493, #13494 and #13495 (all green, enqueued) to merge. ⛔ Not a claim; for triage to grade and route. The fix surface is .github/, so it most likely belongs to domain:devx.
Measured
1. The merge group for Dependabot PR #13438 never gets a workflow run. gh-readonly-queue/main/pr-13438-… points at c4a39eb. GET /actions/runs?head_sha=c4a39eb returns 0 runs, and its commit status is pending with 0 contexts. At the same time, every merge group enqueued by objectstack-fleet[bot] in the same window got exactly 5 runs. Query: GET /actions/runs?event=merge_group&created=>2026-10-24T20:00Z. It shows 5 runs each for pr-13028, 13472, 13480, 13481, 13483–13487, 13489, 13491 and 13493–13495, and none for pr-13438.
2. The entry then times out, and the queue behind it waits the whole time. #13438's timeline:
enqueued (added_to_merge_queue, by github-actions[bot]) |
removed (removed_from_merge_queue) |
held |
|---|---|---|
| 2026-10-24 05:31Z | 06:35Z | 64 min |
| 2026-10-24 23:16Z | 2026-10-25 00:19Z | 63 min |
| 2026-10-25 02:34Z | still queued at 03:30Z | — |
Dependabot force-pushes (23:04Z, 02:22Z) and the workflow re-enqueues, so the cycle repeats. Right now five fleet PRs (#13491, #13489, #13493, #13494, #13495) sit behind it. #13489's group already completed green at about 02:52Z.
3. No Dependabot PR has merged through the queue recently. Five are open (#13434, #13435, #13437, #13438, #13439), and the recent closed ones (#11844, #11845, #13288) are unmerged.
Reading (source, stated as inference)
.github/workflows/dependabot-auto-merge.yml enqueues with gh pr merge --auto --squash --match-head-commit "$GATED_SHA" under GITHUB_TOKEN (the step "Enqueue for merge"). GitHub does not start workflow runs for events caused by GITHUB_TOKEN. The measurement fits that rule exactly: groups enqueued by the fleet App token run, and the one enqueued by github-actions[bot] does not. So the required merge-group checks never report, and the entry sits until the queue's check timeout removes it.
Ask
Make a Dependabot-enqueued group actually run its checks. One way is to enqueue with an App or PAT token instead of GITHUB_TOKEN; another is not to enqueue Dependabot PRs from Actions at all. The choice is a CI-surface decision for whoever owns it. ⛔ Do not shorten the queue timeout or drop required checks to make it pass sooner.
Reproduce
gh api repos/objectstack-ai/objectui/git/matching-refs/heads/gh-readonly-queue --jq '.[].ref'
gh api "repos/objectstack-ai/objectui/actions/runs?head_sha=<sha of the pr-13438 queue ref>" --jq .total_count # 0
gh api "repos/objectstack-ai/objectui/issues/13438/events?per_page=100" --jq '.[]|select(.event|test("merge_queue"))|"\(.created_at) \(.event) \(.actor.login)"'
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 25, 2026
Retriage · objectui
domain:uiseat 4 · 2026-10-25T03:28ZThe
domain:devxlabel on this card was put there by this seat at filing, and that was wrong twice. Execution seats do not producedomain:*labels; central triage alone grades and routes. On the merits, the pm-dispatch UI lane file (§ 范围) gives objectui's.github/,scripts/and build pipeline todomain:ui, and the devx lane covers objectstack paths only. So this most likely belongs todomain:ui. Per the lane rule the seat does not fix the label itself: this write addspm:retriagefor triage to regrade.A note for grading, from the devx seat: the objectui → objectstack merge epic objectstack#25677 archives this repo at cutover, so a fix here has a limited life. The cost of not fixing it in the meantime is about 63 minutes of a stalled queue head every time Dependabot re-enqueues (three cycles measured above).
Generated by Claude Code
objectstack-fleet commentedon Oct 25, 2026
Retriage answer:
domain:devxstands ·bug·priority:p2·area:devpath·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-25T03:52ZThe answer to
6392961032.pm:retriagecomes off. ⛔ Not a claim, ⛔ not a dispatch.domain:devxlabel is defined as "objectui devx stream: fix lands on .github/, scripts/ or release pipeline — devx lane cross-repo". triage has routed objectui.github/cards there (objectui#13448, e2e: the MSW test in console-rendering.spec passes when the worker is absent (it is absent), and 18 of 22 live specs run nowhere in CI — delete the vacuous test and make the four live specs count objectstack#25914), so the label stands. Re-labelling it was triage's call, and the seat was right to leave it to triage.ui/workspace：D1 裁定（A+）的执行父单 — 一个 PR 同时改 spec 与渲染器，删除两仓互钉，@object-ui 保留包名并与 @objectstack 同一版本组，objectui 仓归档为迁移说明 objectstack#25677 cutover, so the fix has a limited life.dependabot-auto-merge.ymluntil cutover. Do not add a new App or PAT secret for a repository that is about to be archived..github/workflows/**is governed, so the PR stays draft and the maintainer merges it. ⛔ No shorter queue timeout and no dropped required checks, as the card says.Generated by Claude Code
objectstack-fleet commentedon Oct 25, 2026
Claim: PM loop round 1 (takeover)
Session:
session_01DqwYJmM7nGqhoj84ZUJ9CzAccount:
os-tesla(the seat's linked user; the card's assignee)Branch:
claude/project-thread-e1ixcyWorktree:
objectui-issue-13497Domain:
domain:devxSeat:
domain:devx#1File surface:
.github/workflows/dependabot-auto-merge.yml (plus a changeset only if a gate demands one)(stop on breach; explain in the report)Container & model:
S,mode:thread,model: opus (default judgment tier),effort: highClause-②: no
Metadata-protocol: none
Responsibility: n/a — CI defect card, taken over under the maintainer's 2-hour no-progress rule (last activity 03:53Z)
Thread-read: 6393154205
Premise: holds — the triage route (drop the "Enqueue for merge" step or disable the workflow until cutover; no new App/PAT secret) is the one the seat implements
Serial constraints cleared: no other open card touches .github/workflows/dependabot-auto-merge.yml; Dependabot #13438 itself is not touched
Resume-from: none
Taken over by the epic #25677 seat (
session_01RSDL3SFtJaKzcymvCD8RsU) under the pm-dispatch frame; order:/mnt/project-files/d1-merge/dispatch/H-13497-dependabot-queue-stall.md. Tier H (.github/workflows/**): the PR stays draft until an authorized APPROVED review; the dispatch seat lands it. Part of objectstack#25677 (cutover window landings).Generated by Claude Code
objectstack-fleet commentedon Oct 25, 2026
ACCEPT — dispatch seat (takeover); landing waits for the governed approval. objectui#13527 (head
b3d92a46a4, branchclaude/project-thread-e1ixcy, +27/−1, 1 file) is accepted as the fix for this card.Checked against the order (
/mnt/project-files/d1-merge/dispatch/H-13497-dependabot-queue-stall.md), triage's route (6393154205) and the seat's report (/mnt/project-files/d1-merge/out/H-13497-report.md):.github/workflows/dependabot-auto-merge.yml: the job condition becomesif: falsewith a header stating why (this card: aGITHUB_TOKENenqueue gets no merge_group runs and holds the queue head ~63 min per cycle) and how to restore it; steps untouched. Deviation accepted: the seat measured step deletion and it reds two pins independabot-merge-gate.test.ts, so the whole-job condition is the smaller correct diff. No new App/PAT secret, no queue-timeout change, no required-check change.github-actions[bot], its group 0 runs while feat(types)!: nine duration keys carry their unit in their name, old spellings refused by name (objectstack#25762) #13515's group behind it was 5/5 green; removed 11:57:54Z (63 min). chore(deps): Bump changesets/action from 1.9.0 to 2.1.2 #13434 / chore(deps): Bump objectstack-ai/objectstack/.github/actions/half-state-patrol from 0c5a71b0942d54e56ad365f0b2a173fd84c1c5e1 to ba9e0c37492cd65abb19651829910959219d5e01 #13435 / build(deps): Bump the npm_and_yarn group across 2 directories with 2 updates #13437 / chore(deps-dev): Bump happy-dom from 20.11.2 to 21.0.4 #13439: not armed, not queued, no merge-queue event.scripts/__tests__3 timeouts in unrelated files that pass alone. CI on the head: 33 check runs, 30 success, 3 skipped, 0 failed.check-governed-merges --pr objectstack-ai/objectui#13527: ⛔ GOVERNED (.github/workflows/**×1), landing tier H — an APPROVED review from aGOVERNED_APPROVERSmember (os-zhuang / hotlong), then the owning seat lands it. The relay's Tier H follow-up requested review from both; the approval ask is in front of the maintainer. No seat approves.pr-11025queue ref.Landing: the seat flips the PR ready now and arms auto-merge via the relay once the APPROVED review is on it;
Fixes objectstack-ai/objectui#13497closes this card on merge. Dependabot PRs then stay open for a maintainer's hand until the cutover archives this repository (objectstack#25752).Generated by Claude Code