From 8906172c885cceb677c0c753dd9572b7fafe9476 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Thu, 17 Sep 2026 16:55:35 -0400 Subject: [PATCH] NO-ISSUE: require branches to be up to date for merge-queue repos Merge queue only re-validates checks that listen for merge_group (unit tests, lint); checks without that trigger -- including all three e2e-*-gate checks -- keep whatever result they last posted on the PR's own head SHA. A PR can sit stale relative to main (e.g. after a paired osac + osac-test-infra change lands) and still merge on old green checks. Drop the merge_queue exception so strict_required_status_checks_policy is always true, forcing a fresh required-check run against a rebased head before merge. Co-Authored-By: Claude Sonnet 5 Signed-off-by: Elior Erez --- modules/common_repository/main.tf | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index 902e314..226fe85 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -159,9 +159,13 @@ resource "github_repository_ruleset" "status_checks" { } required_status_checks { - # When merge queue is enabled, strict is unnecessary — the queue tests - # each PR against latest main before merging. - strict_required_status_checks_policy = var.merge_queue != null ? false : true + # Merge queue only re-validates checks that actually listen for + # merge_group (e.g. unit tests, lint) against its rebased ref -- checks + # without that trigger (e.g. the e2e-*-gate checks) keep whatever + # result they last posted on the PR's own head SHA. Without strict, + # main can drift out from under a stale-but-still-green PR (e.g. a + # paired osac/osac-test-infra change lands) and it merges anyway. + strict_required_status_checks_policy = true dynamic "required_check" { for_each = var.required_status_checks