Skip to content

feat(runway): git merger SQUASH_REBASE and MERGE - #461

Open
behinddwalls wants to merge 1 commit into
preetam/runway-git-merger-rebasefrom
preetam/runway-git-merger-squash-merge
Open

feat(runway): git merger SQUASH_REBASE and MERGE#461
behinddwalls wants to merge 1 commit into
preetam/runway-git-merger-rebasefrom
preetam/runway-git-merger-squash-merge

Conversation

@behinddwalls

@behinddwalls behinddwalls commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

Summary

Why?

The git merger landed with REBASE only. SQUASH_REBASE and MERGE are part of the wire contract SubmitQueue already publishes against, and until they apply here a request naming either is rejected as an invalid request. This adds the two remaining transforming strategies on top of the shared apply machinery.

What?

SQUASH_REBASE applies each change exactly like REBASE — replaying every commit it introduces — then collapses what that change produced into a single commit. The squash unit is the change: a change of ten commits becomes one, and a step whose change carries several URIs yields one commit per URI. Those URIs are a stack of pull requests, and squashing them together would erase the per-PR boundary the stack exists to express.

Two degenerate cases produce no output rather than an empty commit. A change already present on the target creates no commits, so there is nothing to squash. A change that does create commits whose net tree matches the base would squash to an empty commit, so the intermediates are dropped. Both keep redelivery idempotent.

MERGE creates a --no-ff merge commit per change, which keeps the change's original commits reachable through second-parent history — the property that separates it from the picking strategies, which rewrite those hashes. A change already contained in HEAD is skipped rather than merged again.

Not every failed merge is a conflict. applyMerge previously reported any git merge failure as ErrConflict, which tells the client its change collides with the target even when nothing collided. Failures are now classified, and the case that matters in practice is an unrelated history.

Importing an unrelated history. A repository migration arrives as an ordinary change in the target repo whose branch carries the source repo's whole history. Being in the target repo is what makes the commits fetchable; it says nothing about ancestry, and git refuses to merge two graphs with no common ancestor. AllowUnrelatedHistories lifts that refusal for a queue that exists to perform such imports. It is off by default because the refusal is a genuine safeguard — with it always on, merging the wrong object silently produces a nonsense result instead of failing. Without the option, the refusal is now reported as an invalid request rather than a conflict.

MERGE is the only strategy that can serve a migration: it is the only one that preserves the imported commits' original hashes, and the picking strategies have no range to compute across disjoint graphs, so they reject such a change explicitly and say so.

Test Plan

bazel test //runway/extension/merger/git:go_default_test — passes (58s)

New coverage: SQUASH_REBASE collapsing a multi-commit change into one commit while landing all of its content, a two-URI change yielding one squashed commit per URI in application order, SQUASH_REBASE over an already-landed change producing none, MERGE creating one merge commit for a multi-commit change, MERGE skipping a change already an ancestor of the tip, and the MERGE dry-run path.

For migration specifically: importing a three-commit unrelated history and asserting every imported commit is reachable under its original hash, the merge commit has two parents, and the target keeps its own files; redelivery of the same request being a no-op; the import rejected as an invalid request (explicitly not a conflict) when the option is off, leaving the remote and checkout untouched; and both picking strategies rejecting an unrelated history rather than rewriting it.

Stack

  1. feat(runway): dlq reconciler for merge topics #459
  2. feat(runway): git-backed merger with REBASE #460
  3. @ feat(runway): git merger SQUASH_REBASE and MERGE #461
  4. feat(runway): git merger PROMOTE #462
  5. feat(runway): wire the git merger into the server #463
  6. feat(runway): reject changes that disagree on provider #476
  7. docs: define the URI as the unit of change #477

@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-rebase branch from ffa903d to bab2ff3 Compare July 30, 2026 16:12
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-squash-merge branch from b993dff to 4402c53 Compare July 30, 2026 16:12
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-rebase branch from bab2ff3 to b56440e Compare July 30, 2026 16:16
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-squash-merge branch from 4402c53 to 9f7c9c0 Compare July 30, 2026 16:16
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-rebase branch from b56440e to 4820747 Compare July 30, 2026 16:51
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-squash-merge branch from 9f7c9c0 to 7a32efb Compare July 30, 2026 16:51
@behinddwalls
behinddwalls marked this pull request as ready for review July 30, 2026 17:06
@behinddwalls
behinddwalls requested review from a team and sbalabanov as code owners July 30, 2026 17:06
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-rebase branch from 4820747 to 8130e8f Compare July 30, 2026 17:13
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-squash-merge branch 2 times, most recently from 324ed18 to 7e8e1e6 Compare July 30, 2026 17:55
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-rebase branch 2 times, most recently from d2b5239 to e96766d Compare July 30, 2026 18:05
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-squash-merge branch from 7e8e1e6 to e85c9ca Compare July 30, 2026 18:05
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-squash-merge branch from e85c9ca to f5df112 Compare July 30, 2026 19:25
behinddwalls added a commit that referenced this pull request Jul 30, 2026
## Summary

### Why?

SubmitQueue records in-flight merge work before publishing and then
waits for exactly one `MergeResult` echoing its correlation id. Runway
is stateless and the sole responder on that id, so every request must
resolve to a result — or the client waits forever.

The primary controllers resolve what they can name: conflicts and
invalid requests become a `FAILED` result, infrastructure faults are
nacked for retry. But a fault that never recovers exhausts the retry
budget and dead-letters. Nothing consumed those dead-letter topics, so
the request produced no signal at all and the client's correlation id
hung indefinitely.

### What?

Adds `runway/controller/dlq`, a reconciler that subscribes to an inbound
topic's `_dlq` queue and, for each dead-lettered `MergeRequest`,
republishes a `FAILED` `MergeResult` echoing the correlation id to the
corresponding signal topic. `dlq.TopicKey` derives the DLQ topic key
from the primary one so the two stay in lockstep.

Unlike the SubmitQueue and Stovepipe DLQ reconcilers this one writes no
entity state — Runway has none, and the signal *is* the resolution. A
payload that cannot be decoded carries no correlation id and is dropped
rather than retried forever.

Wires two instances in the server (one per inbound topic) on a dedicated
consumer running under `errs.AlwaysRetryableProcessor`, so a transient
publish failure retries indefinitely rather than dead-lettering the
dead-letter. The DLQ consumer is started alongside the primary one and
stopped with the same 30s drain on shutdown; both stop errors are joined
into the exit status.

## Test Plan

✅ `bazel test //runway/...` — 5/5 pass, including new
`//runway/controller/dlq` coverage for republish-on-dead-letter, the
drop-undecodable-payload path, and publish-failure propagation
✅ `bazel build //service/runway/...` — wiring compiles
✅ `make gazelle`, `make fmt`


## Stack
1. @ #459
1. #460
1. #461
1. #462
1. #463
1. #476
1. #477
behinddwalls added a commit that referenced this pull request Jul 30, 2026
## Summary

### Why?

PR #443 disabled this workflow outright (`if: false`) when the repo moved to GitHub's native stacked PRs. That was too blunt: native stacks and hand-rolled `arh` chains coexist here today. Stacks #470, #472 and #474 are native, while #460#461#462#463#476 is a plain chain whose every member reports `stack: null`. With the workflow off, merging any PR in a hand-rolled chain leaves the children still carrying their parent's commits — precisely the broken-diff problem this workflow was written to fix.

GitHub owns the lifecycle of its own stacks: on a partial merge it rebases and retargets the surviving members itself, so the workflow must not touch those. It only needs to tell the two apart rather than give up on both.

### What?

Re-enables the job and skips only the PRs GitHub actually owns, instead of switching the whole workflow off.

A `detect_stack` helper resolves native-stack membership from `GET /repos/{owner}/{repo}/pulls/{n}`. It queries the REST API at run time rather than reading `github.event.pull_request.stack` off the webhook payload, so a PR added to a stack after the merge event was queued is still recognised. Membership survives merge — a merged member still reports its stack — which is what makes the lookup meaningful at this point in the lifecycle.

The check is applied **per child PR**, not to the merged PR. GitHub only ever rebases a stack's own members; a PR that targets a member's head branch without joining the stack is invisible to that machinery. Skipping the whole chain whenever the merged PR happened to be a stack member would therefore strand such a PR with exactly the broken diff this workflow exists to prevent. `rebase_chain` always runs; each child that is a stack member is skipped and not recursed into, while its siblings rebase normally. Membership of the merged PR is logged for context and gates nothing.

Presence is tested on the `stack` object itself rather than on `stack.number`. Probing a sub-field means a stack object arriving without that field reads as "standalone" and gets force-pushed — the unsafe direction to fail in. The number is used only for logging. An unreadable response still falls back to standalone, since the Stacks API 404s when the feature is not enabled for a repo, which is exactly when the rebase is wanted.

`cleanup_orphaned_merged_branches` still runs on every merge, including those where every child turned out to be GitHub's to rebase. This workflow therefore remains the sole owner of head-branch deletion, and native-stack head branches are reaped here too, each on the first merge after GitHub has retargeted its successors off it.

This depends on "Automatically delete head branches" being OFF, as the header has always documented — otherwise GitHub retargets children to `main` before the job runs and the non-native path silently no-ops on a green job. The setting has been turned off on the repo.

## Test Plan

✅ YAML parses; job `if` and step `env` verified after the edit.

✅ `bash -n` clean on the extracted `run:` block under bash 5.2, the version Actions runners use. Note for future edits: macOS `/bin/bash` 3.2 reports a spurious `syntax error near ';;'` on this script — it cannot parse the heredoc nested in `$( )`, so it blames a line far from the real construct.

✅ `actionlint` v1.7.7 — clean.

✅ `zizmor` v1.25.2 (`--no-online-audits`, the version CI pins) — no findings, 2 ignored and 5 suppressed, confirming the existing `.github/zizmor.yml` exceptions still cover the file.

✅ `yamlfmt` v0.16.0 `-lint` — clean.

✅ `detect_stack` exercised against live PRs in this repo:

| PR | `.stack` | Result |
| --- | --- | --- |
| #467 | stack #470, position 4/6, merged | native → skipped |
| #468 | stack #470, position 5/6, open | native → skipped |
| #404 | stack #472 | native → skipped |
| #457 | stack #475, size 1 | native → skipped |
| #443 | `null` | standalone → rebased |
| #460 | `null` | standalone → rebased |
| #999999 | HTTP 404 | warns, treated as standalone, no `set -euo pipefail` abort |

✅ The sub-field trap verified directly: a synthetic `{"stack":{"id":51488,"position":4,"size":6}}` with no `number` reads as standalone under `.stack.number // empty`, and as in-a-stack under the expression shipped here.

✅ Observed reference case — the merge of #467 (position 4 of stack #470). GitHub retargeted #468 from `preetam/stovepipe-buildsignal-outcome` to `main` and left #469 on #468's branch, confirming both that GitHub handles its own members and that a merged member retains its `stack` object.

The rebase itself can only be exercised post-merge. On the next merge of a hand-rolled chain (the runway series is the live case) watch for `=== Stack rebase complete ===` and a child retargeted with only its own commits; on a native-stack merge watch for each member child logging `skipped: belongs to native stack #N`, followed by the branch sweep. The first sweep will also reap `preetam/stovepipe-buildsignal-outcome`, which is currently orphaned — it merged after auto-delete was turned off and has no open dependents.
behinddwalls added a commit that referenced this pull request Jul 30, 2026
## Summary

### Why?

PR #443 disabled this workflow outright (`if: false`) when the repo
moved to GitHub's native stacked PRs. That was too blunt: native stacks
and hand-rolled `arh` chains coexist here today. Stacks #470, #472 and
#474 are native, while #460#461#462#463#476 is a plain chain
whose every member reports `stack: null`. With the workflow off, merging
any PR in a hand-rolled chain leaves the children still carrying their
parent's commits — precisely the broken-diff problem this workflow was
written to fix.

GitHub owns the lifecycle of its own stacks: on a partial merge it
rebases and retargets the surviving members itself, so the workflow must
not touch those. It only needs to tell the two apart rather than give up
on both.

### What?

Re-enables the job and skips only the PRs GitHub actually owns, instead
of switching the whole workflow off.

A `detect_stack` helper resolves native-stack membership from `GET
/repos/{owner}/{repo}/pulls/{n}`. It queries the REST API at run time
rather than reading `github.event.pull_request.stack` off the webhook
payload, so a PR added to a stack after the merge event was queued is
still recognised. Membership survives merge — a merged member still
reports its stack — which is what makes the lookup meaningful at this
point in the lifecycle.

The check is applied **per child PR**, not to the merged PR. GitHub only
ever rebases a stack's own members; a PR that targets a member's head
branch without joining the stack is invisible to that machinery.
Skipping the whole chain whenever the merged PR happened to be a stack
member would therefore strand such a PR with exactly the broken diff
this workflow exists to prevent. `rebase_chain` always runs; each child
that is a stack member is skipped and not recursed into, while its
siblings rebase normally. Membership of the merged PR is logged for
context and gates nothing.

Presence is tested on the `stack` object itself rather than on
`stack.number`. Probing a sub-field means a stack object arriving
without that field reads as "standalone" and gets force-pushed — the
unsafe direction to fail in. The number is used only for logging. An
unreadable response still falls back to standalone, since the Stacks API
404s when the feature is not enabled for a repo, which is exactly when
the rebase is wanted.

`cleanup_orphaned_merged_branches` still runs on every merge, including
those where every child turned out to be GitHub's to rebase. This
workflow therefore remains the sole owner of head-branch deletion, and
native-stack head branches are reaped here too, each on the first merge
after GitHub has retargeted its successors off it.

This depends on "Automatically delete head branches" being OFF, as the
header has always documented — otherwise GitHub retargets children to
`main` before the job runs and the non-native path silently no-ops on a
green job. The setting has been turned off on the repo.

## Test Plan

✅ YAML parses; job `if` and step `env` verified after the edit.

✅ `bash -n` clean on the extracted `run:` block under bash 5.2, the
version Actions runners use. Note for future edits: macOS `/bin/bash`
3.2 reports a spurious `syntax error near ';;'` on this script — it
cannot parse the heredoc nested in `$( )`, so it blames a line far from
the real construct.

✅ `actionlint` v1.7.7 — clean.

✅ `zizmor` v1.25.2 (`--no-online-audits`, the version CI pins) — no
findings, 2 ignored and 5 suppressed, confirming the existing
`.github/zizmor.yml` exceptions still cover the file.

✅ `yamlfmt` v0.16.0 `-lint` — clean.

✅ `detect_stack` exercised against live PRs in this repo:

| PR | `.stack` | Result |
| --- | --- | --- |
| #467 | stack #470, position 4/6, merged | native → skipped |
| #468 | stack #470, position 5/6, open | native → skipped |
| #404 | stack #472 | native → skipped |
| #457 | stack #475, size 1 | native → skipped |
| #443 | `null` | standalone → rebased |
| #460 | `null` | standalone → rebased |
| #999999 | HTTP 404 | warns, treated as standalone, no `set -euo
pipefail` abort |

✅ The sub-field trap verified directly: a synthetic
`{"stack":{"id":51488,"position":4,"size":6}}` with no `number` reads as
standalone under `.stack.number // empty`, and as in-a-stack under the
expression shipped here.

✅ Observed reference case — the merge of #467 (position 4 of stack
#470). GitHub retargeted #468 from
`preetam/stovepipe-buildsignal-outcome` to `main` and left #469 on
#468's branch, confirming both that GitHub handles its own members and
that a merged member retains its `stack` object.

The rebase itself can only be exercised post-merge. On the next merge of
a hand-rolled chain (the runway series is the live case) watch for `===
Stack rebase complete ===` and a child retargeted with only its own
commits; on a native-stack merge watch for each member child logging
`skipped: belongs to native stack #N`, followed by the branch sweep. The
first sweep will also reap `preetam/stovepipe-buildsignal-outcome`,
which is currently orphaned — it merged after auto-delete was turned off
and has no open dependents.
Comment on lines +799 to +811
// isEmptyHEADCommit returns true when HEAD's tree matches HEAD^'s tree — i.e.
// the most recent commit introduces no changes.
func (m *gitMerger) isEmptyHEADCommit(ctx context.Context) (bool, error) {
headTree, err := m.commitTreeSHA(ctx, "HEAD")
if err != nil {
return false, err
}
parentTree, err := m.commitTreeSHA(ctx, "HEAD^")
if err != nil {
return false, err
}
return headTree == parentTree, nil
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI-generated: isEmptyHEADCommit is dead code — defined but never called. squashChange compares trees via commitTreeSHA directly.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct — deleted. It was a leftover from an earlier draft of the squash path that compared HEAD to HEAD^; squashChange ended up comparing the pre-pick tree to the post-pick tree instead, which is the check that actually handles a multi-commit range, and the helper was never wired up. Nothing else referenced it.


// commitTreeSHA returns the tree SHA recorded in the commit object at ref.
func (m *gitMerger) commitTreeSHA(ctx context.Context, ref string) (string, error) {
out, err := m.run(ctx, nil, "cat-file", "commit", ref)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI-generated nit: Parsing cat-file commit output manually to extract the tree SHA. rev-parse ref^{tree} does the same in one call and is less fragile.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed — switched to git rev-parse <ref>^{tree}.

Same one invocation, and it drops the hand-rolled parse along with the "unexpected first line" error branch that existed only because the old form could return something unparseable. rev-parse either resolves the tree or exits non-zero, so the remaining error path is the real one.

Covered by the existing squash tests — the empty-squash case (a change whose net tree matches the base) is decided entirely by this comparison.

@kevinlnew kevinlnew left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm. Left a couple nits.

## Summary

### Why?

The git merger landed with REBASE only. `SQUASH_REBASE` and `MERGE` are part of the wire contract SubmitQueue already publishes against, and until they apply here a request naming either is rejected as an invalid request. This adds the two remaining transforming strategies on top of the shared apply machinery.

### What?

**SQUASH_REBASE** applies each change exactly like REBASE — replaying every commit it introduces — then collapses what that change produced into a single commit. The squash unit is the change: a change of ten commits becomes one, and a step whose change carries several URIs yields one commit per URI. Those URIs are a stack of pull requests, and squashing them together would erase the per-PR boundary the stack exists to express.

Two degenerate cases produce no output rather than an empty commit. A change already present on the target creates no commits, so there is nothing to squash. A change that does create commits whose net tree matches the base would squash to an empty commit, so the intermediates are dropped. Both keep redelivery idempotent.

**MERGE** creates a `--no-ff` merge commit per change, which keeps the change's original commits reachable through second-parent history — the property that separates it from the picking strategies, which rewrite those hashes. A change already contained in HEAD is skipped rather than merged again.

**Not every failed merge is a conflict.** `applyMerge` previously reported any `git merge` failure as `ErrConflict`, which tells the client its change collides with the target even when nothing collided. Failures are now classified, and the case that matters in practice is an unrelated history.

**Importing an unrelated history.** A repository migration arrives as an ordinary change in the target repo whose branch carries the source repo's whole history. Being in the target repo is what makes the commits fetchable; it says nothing about ancestry, and git refuses to merge two graphs with no common ancestor. `AllowUnrelatedHistories` lifts that refusal for a queue that exists to perform such imports. It is off by default because the refusal is a genuine safeguard — with it always on, merging the wrong object silently produces a nonsense result instead of failing. Without the option, the refusal is now reported as an invalid request rather than a conflict.

MERGE is the only strategy that can serve a migration: it is the only one that preserves the imported commits' original hashes, and the picking strategies have no range to compute across disjoint graphs, so they reject such a change explicitly and say so.

## Test Plan

✅ `bazel test //runway/extension/merger/git:go_default_test` — passes (58s)

New coverage: SQUASH_REBASE collapsing a multi-commit change into one commit while landing all of its content, a two-URI change yielding one squashed commit per URI in application order, SQUASH_REBASE over an already-landed change producing none, MERGE creating one merge commit for a multi-commit change, MERGE skipping a change already an ancestor of the tip, and the MERGE dry-run path.

For migration specifically: importing a three-commit unrelated history and asserting every imported commit is reachable **under its original hash**, the merge commit has two parents, and the target keeps its own files; redelivery of the same request being a no-op; the import rejected as an invalid request (explicitly not a conflict) when the option is off, leaving the remote and checkout untouched; and both picking strategies rejecting an unrelated history rather than rewriting it.
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-rebase branch from e96766d to f31f570 Compare July 30, 2026 23:38
@behinddwalls
behinddwalls force-pushed the preetam/runway-git-merger-squash-merge branch from f5df112 to 5646e4c Compare July 30, 2026 23:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants