Skip to content

gh-prs-merge --fix: resolve lockfile-only conflicts instead of skipping (0.69.0) - #197

Merged
ralyodio merged 1 commit into
masterfrom
prs-merge-lockfiles
Oct 19, 2026
Merged

ralyodio merged 1 commit into
masterfrom
prs-merge-lockfiles

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

gh-prs-merge-all skipped rssamplifier.com#241 as mergeable=CONFLICTING when the only conflict was bun.lock. That had to be fixed by hand.

What changed: under --fix, a DIRTY PR whose only conflicting files are lockfiles is repaired:

  • blobless clone under ~/.cache/gh-prs-merge (not /tmp), then merge the base in
  • take the base's lockfile and rebuild it with bun|pnpm install --lockfile-only --ignore-scripts or npm install --package-lock-only --ignore-scripts
  • push the merge commit as a normal push (never a force push), park the PR, merge once CI is green

These cases stay FIXME and now print the reason: fork PRs, a head that moved, any non-lockfile conflict, a refused push. yarn.lock is excluded because classic yarn has no lockfile-only mode.

Tested:

  • 9 new tests (sweep path and resolver)
  • smoke test with real git + bun against a local bare repo: the rebuilt lockfile kept the branch's dep and main's bump, the push only moved the branch forward, and the clone dir was removed
  • the full suite has one failure, test/proxy.test.ts, which fails on master too

🤖 Generated with Claude Code

…ng (0.69.0)

A DIRTY PR whose only conflicting files are bun.lock(b), pnpm-lock.yaml or
package-lock.json is not two authors disagreeing: both sides bumped deps and
the merged package.json already says what each wanted. --fix now merges the
base in a blobless clone under ~/.cache, takes the base's lockfile, rebuilds
it lockfile-only with --ignore-scripts, pushes the merge commit (never a
force push) and parks the PR for CI. Forks, moved heads, code conflicts and
refused pushes stay FIXME, now naming the reason.

Seen on rssamplifier.com#241: skipped as mergeable=CONFLICTING over bun.lock alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

33 finding(s)

HIGH/CRITICAL: 7 | MEDIUM: 12 | LOW: 14

Severity Rule Location
HIGH py-ssrf-outbound-request dev2/dev2-site:151
HIGH py-ssrf-outbound-request dev2/dev2-site:1060
HIGH py-ssrf-outbound-request dev2/dev2-site:1775
HIGH sh-remote-script-execution root-ubuntu.sh:3250
HIGH sh-remote-script-execution root-ubuntu.sh:3251
HIGH sh-remote-script-execution root-ubuntu.sh:5146
HIGH sh-remote-script-execution root-ubuntu.sh:5150
MEDIUM sql-template-interpolation dev2/dev2-site:1286
MEDIUM sql-template-interpolation dev2/dev2-site:1363
MEDIUM sh-remote-script-execution root-ubuntu.sh:5354
MEDIUM redos-nested-quantifier src/domain-free.ts:56
MEDIUM redos-nested-quantifier src/emoji.ts:167
MEDIUM redos-nested-quantifier src/icon.ts:166
MEDIUM redos-nested-quantifier src/mail.ts:1047
MEDIUM sql-template-interpolation src/users-dump.ts:487
MEDIUM sql-string-concatenation src/users-dump.ts:507
MEDIUM sql-template-interpolation src/users-dump.ts:540
MEDIUM sql-string-concatenation src/users-dump.ts:574
MEDIUM redos-nested-quantifier src/wcag.ts:556
LOW secret-generic-credential src/credentials.ts:36
LOW secret-generic-credential src/credentials.ts:53
LOW secret-generic-credential src/credentials.ts:56
LOW secret-generic-credential src/credentials.ts:61
LOW secret-generic-credential src/user-export.ts:689
LOW secret-generic-credential src/user-export.ts:695
LOW secret-generic-api-key test/credentials.test.ts:208
LOW secret-generic-credential test/mail.test.ts:141
LOW secret-generic-credential test/proxy.test.ts:69
LOW secret-generic-credential test/proxy.test.ts:85
LOW secret-generic-credential test/shorten.test.ts:36
LOW secret-database-url test/users-dump.test.ts:108
LOW secret-database-url test/users-dump.test.ts:119
LOW secret-database-url test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 9c2c8fa into master Oct 19, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant