[krishhgg]

What changes

Main requires no status check today, so a pull request with red CI could merge, and every "ready to merge" so far was a hand check. This adds what the main ruleset will require once the ruleset change lands (a separate step after this merges):

Status	Passes when
merge-gate/greptile	Greptile reviewed the head and scored it 5/5. Read from the newest description edit by greptile-apps in GitHub's edit history, which must hold exactly one score and one reviewed commit, so a block the author typed or changed never counts.
merge-gate/accepted	The owner added the accepted label, and nobody removed it since.
merge-gate/evidence	The maintainer checked a real-Mac report for the head, or the pull request only touches docs/, Tests/, .github/, .greptile/, README, CONTRIBUTING, SECURITY, LICENSE or .gitignore.
merge-gate/config	Every changed file is a kind no check reads as settings, or the author is the owner, or the owner OK'd it at the head. The safe kinds are an allowlist: Swift sources and tests, text docs (md, html, svg), skills, the product's scripts (not the lid gate script CI runs), plists under Resources/, and the root README and LICENSE (SECURITY.md and CONTRIBUTING.md set policy, and Greptile reads them as guidance for every review). Among them, these still count: a dot-named file; an AGENTS.md, CLAUDE.md or GEMINI.md (and their override and local forms); a diff that adds a ShellCheck directive or a Swift @diagnose or @warn in any spelling; a file GitHub sends no diff for (too big, or binary, which one NUL byte makes a script), unless it was deleted; a changed symlink or submodule, read from the head's tree; and any non-ASCII name. The safe kinds match only in their exact case, so scripts/backstop.SH, which CI's scripts/*.sh checks skip but a Mac opens as scripts/backstop.sh, counts; the names that count match in any case. Anything else, such as .github/, Package.swift or an image, waits for the owner, since no reviewer can read an image and a script could source one. A fork's pull_request run uses the fork's workflow files, so a changed ci.yml could report a job as passed without running it.
merge-gate/codex	The maintainer's Codex review of the head has nothing open.

• .github/scripts/merge-gate.sh
  • evaluate posts what GitHub data settles and pending with a reason for the rest. The owner's newest success or failure on evidence, config or codex always wins. The changed files come from comparing main with the head commit, not from the pull request.
  • post lets the maintainer set codex, evidence or config, only on the current head, then starts the workflow for that pull request.
  • check prints every gate. It works each gate out again from GitHub's data, so a removed label, a lower Greptile score or the owner's newer failure fails before the workflow catches up. It also checks what GitHub doesn't: that each CI job's newest run tested a merge with the current main, and that a ruleset the person running it can't bypass requires every check. For each required check it counts what GitHub counts, including a status that shares a check run's name. Names match in any case, as GitHub matches status names, and the newest check run under each spelling must pass, so a passing Mac-Mini can't hide a failing mac-mini. Last, if every row passed, it reads the pull request, the gates and main again and fails if any changed during the check.
  • merge refuses unless check passes, then merges pinned to the checked head. GitHub still enforces every required check at the merge. What it can't see is a change the workflow hasn't posted yet, so a label removed, a lower Greptile score or a main that moved in the few seconds between the check's last reads and the merge goes unseen.
  • rerun toggles draft so CI tests against the current main without a push.
• .github/workflows/merge-gate.yml runs evaluate on pull_request_target events, hourly as a safety net, and on dispatch. Every run for one pull request shares a concurrency group, so two runs never interleave. It checks out main and reads pull requests through the API only. It never checks out or runs a pull request's code.
• ci.yml
  • Each job writes a "Tested merge" note naming the main and head commits it tested; check reads it.
  • CI runs on ready_for_review too (for rerun).
  • ShellCheck and the bash 3.2 checks cover .github/scripts.
  • New steps run the merge gate tests under macOS /bin/bash 3.2 and Linux bash 5.
  • The release build and the lid check now run before the tests, so no pull request code has run in the job yet when they do. Test code could otherwise skip them, for example by writing BASH_ENV to $GITHUB_ENV.
  • zizmor's install runs python3 -I, so a venv.py on the branch can't stand in for Python's.
  • The ShellCheck job fails unless every script starts with #!/bin/bash or #!/usr/bin/env bash, and lints with --shell=bash, so a changed shebang can't switch ShellCheck to another shell's rules.
  • The ShellCheck job installs ShellCheck 0.11.0, checked by its sha256, and fails unless the findings that directives hide in scripts/ match .github/shellcheck-hidden.txt, which counts as config. A directive covers the next command, so a { after an existing one and a } at the end of the file would put the rest of the script under it without touching the directive.
• .github/scripts/merge-gate-test.sh and merge-gate-fake-gh.sh: 74 tests that run the gate against a stand-in for gh that answers from files. They cover pagination as gh does it, and answers that change between reads.
• .github/scripts/shellcheck-hidden.sh makes that list. It lints a copy of scripts/ in which each # that whitespace and shellcheck follow becomes #~, so no directive survives, and prints each finding with its file, check and line. The copy must parse as the script does, or a changed line could end a here-document early and hide the code after it, so bash 5.2's --pretty-print, which parses without running anything and drops comments, must print the copy and the script the same. A # shellcheck in a string, a here-document or backticks fails the check. shellcheck-hidden-test.sh runs it on 29 cases, among them a directive in each place ShellCheck honors one (after ;, &, (, a case pattern's ), inside $(), a here-document trick in each direction, a .shellcheckrc, SHELLCHECK_OPTS, $BASH_ENV, a bash older than 5.2 and a ShellCheck that fails. Each directive case first checks that its directive is what hides the finding: ShellCheck must report it once the directive names another check.
• CONTRIBUTING.md: "How a pull request merges" and "Real-Mac evidence". Also a new pull request template.

How it was tested

• merge-gate-test.sh: 74 passed under /bin/bash 3.2.57 locally, and CI runs it under bash 3.2 and 5.
• Mutation check: I broke each fix on purpose, one at a time, and ran the tests: 12 changes for the first Codex review's fixes, 18 for the second's, 11 for the third's, 10 for the fourth's, 9 for the fifth to seventh's, 33 for the config allowlist, 20 for the eighth's and Greptile's ninth review, 14 for the ninth's, 17 for the eleventh's, 15 for the twelfth's, and 18 for the thirteenth to fifteenth's in shellcheck-hidden.sh. The tests failed for every one but four. Three change nothing: an ascii_downcase put back into the image check, now that the allowlist rejects an uppercase extension anyway; dropping the g from shellcheck-hidden.sh's rewrite, since the first # before shellcheck on a line either starts the comment or sits in a string the parse check refuses; and dropping its --shell=bash, since CI requires a bash first line anyway. The fourth reads a listed line's text from the copy, which shows #~ only on a line whose comment holds a # shellcheck after other text; the code reads the script itself, and no test has such a line. The tenth review's fix is in ci.yml, so I checked it instead by linting a copy of a script with a ksh first line, which the new step rejects.
• shellcheck-hidden-test.sh: 29 passed with ShellCheck 0.11.0 and with 0.10.0, parsing with bash 5.2.21 built from GNU's source (Ubuntu 24.04's version). With each directive changed to name another check, every directive case fails, so none passes without testing anything. CI's Ubuntu ShellCheck job ran the earlier version of this check with GNU sed and passed. The list in .github/shellcheck-hidden.txt is the same from both: install.sh's SC2016 and uninstall.sh's SC2034, the two directives main has.
• /bin/bash -n (3.2), CI's bash 4 grep, ShellCheck 0.10.0 and 0.11.0, actionlint 1.7.12 and zizmor 1.30.1, all clean. zizmor reports one ignored finding: the pull_request_target trigger, with the reason inline.
• DRY_RUN=1 merge-gate.sh evaluate 106 104 34 against live pull requests:
  • CI: a merge gate that needs review, evidence and the owner's OK at each head #106 (owner, tooling only) passes greptile, evidence and config, and waits for accepted and codex;
  • Settings: one page, one app list, and a hotspot picker that also takes a typed name #104 (a contributor's app change) waits for evidence;
  • Backstop: end a valid session when the app is gone, the battery is below the end floor, or heat is critical #34's Greptile summary covers 2ff8c6c, not its head c04e86b, so it stays pending.
• DRY_RUN=1 merge-gate.sh evaluate on each of the 33 open pull requests: config passes for 25. Menu bar: Add Compact and Minimal menu bar modes + UX fixes #96, Auto: keep awake for registered agent work #79, Sessions: add unlimited mode with owner-aware recovery #75, Add opt-in hotspot usage tracking and budget warnings #73, Port to macOS 15 (Sequoia) and Swift 6.1 #72, Build a universal binary so release zips install on Intel Macs #64, Menu bar: add Liquid Glass quick actions and native settings #63 and Add standalone desktop control center and portable setup #54 wait for the owner, each for a change the gate should stop: workflow edits in Menu bar: Add Compact and Minimal menu bar modes + UX fixes #96, Port to macOS 15 (Sequoia) and Swift 6.1 #72 and Build a universal binary so release zips install on Intel Macs #64, Package.swift in Port to macOS 15 (Sequoia) and Swift 6.1 #72, SECURITY.md in Add opt-in hotspot usage tracking and budget warnings #73, a new ShellCheck directive in Sessions: add unlimited mode with owner-aware recovery #75, a new desktop/ folder in Add standalone desktop control center and portable setup #54, and screenshots in Auto: keep awake for registered agent work #79 and Menu bar: add Liquid Glass quick actions and native settings #63.
• merge-gate.sh check 106: the four CI jobs pass on main 04e640c. It fails on the missing gate statuses and on the ruleset not requiring them yet, as expected before rollout.
• post refuses an abbreviated SHA and a SHA that isn't the head.

Real-Mac evidence

Not needed: only .github/ and CONTRIBUTING.md change.

🤖 Generated with Claude Code

Confidence Score: 5/5

The reviewed changes appear safe to merge; no new blocking issue was found.

Summary

This PR adds five merge gates for review, owner acceptance, Mac evidence, config approval and Codex review.

• The merge gate posts five checks for each pull-request head.
• Maintainers can check every gate and merge at the checked head.
• CI spots ShellCheck warnings hidden by script directives.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Pull request head] --> B[CI tests merged code]
  A --> C[Read review, label, files and owner decisions]
  C --> D[Post five gate statuses]
  B --> E[check]
  D --> E
  E --> F{All checks pass on current main?}
  F -->|No| G[Refuse merge]
  F -->|Yes| H[Read head, gates and main again]
  H --> I[Merge pinned to checked head]

Loading

_{Reviews (18) · Last reviewed commit: "Merge gate: check that the copy without ..." · Reviewed by Greptile}