ci(gh-merge-green): check merge-freeze issues instead of the WINDOW file

Merged
TE
19d ago
+183-346

Summary

gh-merge-green read merge freezes from ~/agent-mailbox/WINDOW on cmux-lawrence over ssh. Every token there had lapsed by 2026-10-10, but the helper kept refusing on them, and a host without ssh to cmux-lawrence (Huge Blue) couldn't merge into feat-cmux-next at all.

It now runs the merge-freeze issue checker from #21706 instead:

python3 scripts/ci/merge_freeze.py check --repo "$repo" --pr "$num" --base "$base"
  • It runs on every base, not only feat-cmux-next, since a freeze issue names its own branch: (or none, for every branch). changed is still computed for every base, and merged-head checks keep using it.
  • Exit 1 refuses with the freezes the checker prints. Any other non-zero refuses as "freeze state unknown". --override still doesn't lift a freeze; the owner's freeze-ok label does.
  • merge_freeze.py lists the changed files itself, so the renamed-from side of a rename counts, and a list the files API cut short at 3000 refuses instead of clearing the freeze. Tests pass the list as --files with fixtures instead.
  • --freeze-token and --window-token print a warning that they're retired and are ignored, so existing callers keep working.
  • The RELEASE mail that went into cmux-lawrence's coordinator inbox after a token merge is gone, along with all ssh to cmux-lawrence.
  • Under GH_MERGE_GREEN_TEST the checker reads GH_MERGE_GREEN_FREEZE_ISSUES and GH_MERGE_GREEN_FREEZE_EVENTS (default /dev/null), so tests never read the real repository.
  • docs/ci/merge-freeze.md now says gh-merge-green enforces the check.

Testing

  • Regression first: 0a4d3fe32ca adds FreezeRegression (issue fixtures) and RetiredTokenRegression. Against the old script, python3 -m unittest tests.test_gh_merge_green.FreezeRegression tests.test_gh_merge_green.RetiredTokenRegression gave 11 of 12 failing. After the fix it gives 12 of 12 passing. After review, a 13th test checks that a merge into main hits a main freeze. Each test also puts a fake ssh on PATH and asserts nothing called it.
  • python3 -m unittest tests.test_gh_merge_green: 97 tests OK. python3 -m unittest tests/test_merge_freeze.py: 13 OK. tests.test_gh_merge_green_revert: OK.
  • A review subagent approved, and its two medium findings (renames on the GraphQL fallback, the 3000-file cap) are fixed in the last commit. The rename and file-cap paths are covered by merge_freeze.py's own logic, not by a gh-merge-green test.
  • Live and read-only: merge_freeze.py check against real PRs exits 0, and list shows no open freezes right now.
  • scripts/verify-local.py --affected origin/main couldn't give a useful result here: this worktree is a sparse checkout without app sources, so the app-tree checks (xcstrings, project, package-groups and others) fail on missing files. No app code changed. CI's linux-guard lane runs both test files.

Changelog

none

Proof

CI and tooling only.

🤖 Generated with Claude Code