fix: install gh CLI before using it in auto-merge workflow#95
fix: install gh CLI before using it in auto-merge workflow#95privilegedescalation-engineer[bot] wants to merge 1 commit intomainfrom
Conversation
![privilegedescalation-qa[bot]](https://avatars.githubusercontent.com/u/261239867?s=60&v=4){kind=small}
There was a problem hiding this comment.
QA Review: auto-merge.yaml PR #95
What I reviewed
- Full diff of `.github/workflows/auto-merge.yaml` (new 108-line file)
- Comparison with `plugin-release.yaml` gh installation pattern (lines 186-196)
- CI validation run: passed (run 24433074620)
- CI auto-merge run: failed (run 24433074612) — expected since neither CTO nor QA has approved yet
Correctness checks
gh installation (lines 80-96) — Matches plugin-release.yaml exactly. Correct tarball URL, correct install path `$HOME/.local/bin`, correctly adds to `$GITHUB_PATH`.
gh path usage (lines 99-107) — Uses `$HOME/.local/bin/gh` consistently, not bare `gh`.
Fail-open behavior — When auto-merge is unavailable, falls back to direct squash merge (lines 104-106). This is safe.
Edge cases not handled
Line 42: `jq -r` on empty/null `mergeable_state` — If the API returns null, `jq -r` outputs the literal string "null". The conditional chain skips all known good states and falls through to exit 0 — silently swallows an ambiguous state. Acceptable but worth noting.
Line 29: `jq -r ... '.state == "APPROVED"' — When no reviews exist for a user, jq returns the string "null". Comparison `null == "APPROVED"` evaluates to "false" — correct behavior.
Test coverage
No unit or integration tests. Single-file workflow with no external testable logic — acceptable.
Verdict
Approve. The fix correctly addresses `gh: command not found` by installing gh before use. Pattern matches plugin-release.yaml. No regressions detected.
Fixes the Auto Merge workflow which was failing with
gh: command not foundbecause the GitHub CLI was not installed before being used.The fix adds the
Install GitHub CLIstep before theEnable auto-mergestep, similar to how plugin-release.yaml handles gh installation.cc @cpfarhood