fix(ci): require all review threads resolved before queue + merge

a8fa80a387d532159606f7beb56003fedcdbcbb8 · 2026-05-16 14:27:26 -0700 · Trevin Chow

Mergify's queue_conditions and success_conditions both gate on the
Greptile Review check_run being success/neutral/skipped, but that
check_run only reflects the confidence score — it does not track
whether Greptile's inline P0/P1 findings have actually been resolved.
So a PR with unresolved review threads can today:

1. Pass all CI checks (build-and-test, generated-test, etc.)
2. Pass Greptile Review (score >= threshold)
3. Get labeled ready-to-merge
4. Auto-merge via Mergify, with the findings still open

PR #1514 is the canonical example today: mergeStateStatus=CLEAN with
one unresolved Greptile thread. The downstream library repo had the
same gap and closed it via a ruleset rule + a visibility check_run
(mvanhorn/printing-press-library#620, #621). This repo uses Mergify
instead of rulesets, so the equivalent fix is a Mergify-native
condition.

Adding `#review-threads-unresolved = 0` to both queue_conditions and
success_conditions means:

- Mergify won't queue a PR with unresolved threads
- Mergify won't merge a PR that picks up new findings during the
  in-place queue re-run
- Mergify's status comments will explicitly cite the unresolved
  threads as the blocker, so authors see what to do

Release-please PRs are bot-generated and reliably have zero review
threads, so the condition passes them through transparently — no
exemption needed for the existing release-please branch pattern.

Files touched

M .mergify.yml

Diff

commit a8fa80a387d532159606f7beb56003fedcdbcbb8
Author: Trevin Chow <trevin@trevinchow.com>
Date:   Sat May 16 14:27:26 2026 -0700

    fix(ci): require all review threads resolved before queue + merge
    
    Mergify's queue_conditions and success_conditions both gate on the
    Greptile Review check_run being success/neutral/skipped, but that
    check_run only reflects the confidence score — it does not track
    whether Greptile's inline P0/P1 findings have actually been resolved.
    So a PR with unresolved review threads can today:
    
    1. Pass all CI checks (build-and-test, generated-test, etc.)
    2. Pass Greptile Review (score >= threshold)
    3. Get labeled ready-to-merge
    4. Auto-merge via Mergify, with the findings still open
    
    PR #1514 is the canonical example today: mergeStateStatus=CLEAN with
    one unresolved Greptile thread. The downstream library repo had the
    same gap and closed it via a ruleset rule + a visibility check_run
    (mvanhorn/printing-press-library#620, #621). This repo uses Mergify
    instead of rulesets, so the equivalent fix is a Mergify-native
    condition.
    
    Adding `#review-threads-unresolved = 0` to both queue_conditions and
    success_conditions means:
    
    - Mergify won't queue a PR with unresolved threads
    - Mergify won't merge a PR that picks up new findings during the
      in-place queue re-run
    - Mergify's status comments will explicitly cite the unresolved
      threads as the blocker, so authors see what to do
    
    Release-please PRs are bot-generated and reliably have zero review
    threads, so the condition passes them through transparently — no
    exemption needed for the existing release-please branch pattern.
---
 .mergify.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.mergify.yml b/.mergify.yml
index 7ad70769..cd7bd3f8 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -9,6 +9,12 @@ queue_rules:
     # timing out waiting for Greptile.
     queue_conditions:
       - base = main
+      # All Greptile/human inline review threads must be resolved before
+      # the PR enters the queue. Greptile Review's check_run going green
+      # only reflects the confidence score, not whether inline findings
+      # are addressed; without this condition a PR with unresolved P0/P1
+      # findings would auto-merge as soon as `ready-to-merge` is applied.
+      - "#review-threads-unresolved = 0"
       - check-success = build-and-test
       - check-success = generated-test
       - check-success = go-lint
@@ -58,6 +64,10 @@ merge_protections:
         - and:
           - head = release-please--branches--main
           - "title ~= ^chore\\(main\\): release"
+      # Mirrors the queue_conditions rule. Belt-and-suspenders so a queued
+      # PR that picks up new Greptile findings during the queue's CI re-run
+      # is held until those threads are resolved.
+      - "#review-threads-unresolved = 0"
       - check-success = build-and-test
       - check-success = generated-test
       - check-success = go-lint

← 4e304df5 fix(cli): scope-aware sync --param dispatch with --global-pa · back to Cli Printing Press · feat(ci): surface unresolved review threads as a status chec 21ae8a54 →