merge-steward 0.8.9 → 0.8.11

package/dist/github/pr-client.d.ts

@@ -16,6 +16,11 @@ export declare class GitHubPRClient implements GitHubPRApi {
     getStatus(prNumber: number): Promise<PRStatus>;
     listChecks(prNumber: number): Promise<CheckResult[]>;
     listChecksForRef(ref: string): Promise<CheckResult[]>;
+    listOpenPRsWithLabel(label: string): Promise<Array<{
+        number: number;
+        branch: string;
+        headSha: string;
+    }>>;
     deleteBranch(prNumber: number): Promise<void>;
     findPRByBranch(branch: string): Promise<number | null>;
     listLabels(prNumber: number): Promise<string[]>;

package/dist/github/pr-client.js

@@ -64,6 +64,24 @@ export class GitHubPRClient {
             return [];
         }
     }
+    async listOpenPRsWithLabel(label) {
+        const result = await exec("gh", [
+            "pr", "list",
+            "--repo", this.repoFullName,
+            "--label", label,
+            "--state", "open",
+            "--json", "number,headRefName,headRefOid",
+        ], { allowNonZero: true, githubRepoFullName: this.repoFullName });
+        if (result.exitCode !== 0)
+            return [];
+        try {
+            const data = JSON.parse(result.stdout);
+            return data.map((pr) => ({ number: pr.number, branch: pr.headRefName, headSha: pr.headRefOid }));
+        }
+        catch {
+            return [];
+        }
+    }
     async deleteBranch(prNumber) {
         const status = await this.getStatus(prNumber);
         await exec("gh", [

package/dist/github/shell-git.d.ts

@@ -1,11 +1,17 @@
 import type { GitOperations, SpeculativeBranchBuilder } from "../interfaces.ts";
 import type { MergeResult } from "../types.ts";
+export interface BotIdentity {
+    name: string;
+    email: string;
+}
 export declare class ShellGitOperations implements GitOperations, SpeculativeBranchBuilder {
     private readonly clonePath;
     private readonly repoFullName;
     private readonly gitBin;
     private readonly worktreeBase;
+    private botIdentity;
     constructor(clonePath: string, repoFullName: string, gitBin?: string);
+    setBotIdentity(identity: BotIdentity): void;
     private git;
     /** Run a git command in a specific directory (worktree). */
     private gitIn;
@@ -19,7 +25,7 @@ export declare class ShellGitOperations implements GitOperations, SpeculativeBra
      * The worktree is removed after the merge; the branch ref persists
      * so the reconciler can push it and reference its SHA.
      */
-    buildSpeculative(prBranch: string, baseBranch: string, specName: string): Promise<MergeResult>;
+    buildSpeculative(prBranch: string, baseBranch: string, specName: string, mergeMessage?: string): Promise<MergeResult>;
     /**
      * During a merge conflict, check if the only unmerged files are lockfiles
      * (package-lock.json). If so, resolve by regenerating from the merged

package/dist/github/shell-git.js

@@ -17,12 +17,16 @@ export class ShellGitOperations {
     repoFullName;
     gitBin;
     worktreeBase;
+    botIdentity;
     constructor(clonePath, repoFullName, gitBin = "git") {
         this.clonePath = clonePath;
         this.repoFullName = repoFullName;
         this.gitBin = gitBin;
         this.worktreeBase = `${clonePath}-worktrees`;
     }
+    setBotIdentity(identity) {
+        this.botIdentity = identity;
+    }
     git(args, opts) {
         return exec(this.gitBin, ["-C", this.clonePath, ...args], {
             timeoutMs: opts?.timeoutMs ?? 120_000,
@@ -68,7 +72,7 @@ export class ShellGitOperations {
      * The worktree is removed after the merge; the branch ref persists
      * so the reconciler can push it and reference its SHA.
      */
-    async buildSpeculative(prBranch, baseBranch, specName) {
+    async buildSpeculative(prBranch, baseBranch, specName, mergeMessage) {
         const wtPath = join(this.worktreeBase, specName);
         // Clean up any leftover worktree/branch from a previous run.
         await this.git(["worktree", "remove", "--force", wtPath], { allowNonZero: true });
@@ -77,11 +81,20 @@ export class ShellGitOperations {
         // Create isolated worktree with spec branch starting at baseBranch.
         mkdirSync(this.worktreeBase, { recursive: true });
         await this.git(["worktree", "add", "-B", specName, wtPath, baseBranch]);
+        // Override git identity so merge commits are attributed to the steward, not the clone owner.
+        if (this.botIdentity) {
+            await this.gitIn(wtPath, ["config", "user.name", this.botIdentity.name]);
+            await this.gitIn(wtPath, ["config", "user.email", this.botIdentity.email]);
+        }
         // Merge PR into spec branch inside the worktree.
         // PR branches are always remote refs — use explicit origin/ prefix
         // because git DWIM doesn't reliably resolve bare names in worktrees.
         const mergeRef = prBranch.startsWith("origin/") ? prBranch : `origin/${prBranch}`;
-        const result = await this.gitIn(wtPath, ["merge", "--no-ff", mergeRef], { allowNonZero: true });
+        const mergeArgs = ["merge", "--no-ff"];
+        if (mergeMessage)
+            mergeArgs.push("-m", mergeMessage);
+        mergeArgs.push(mergeRef);
+        const result = await this.gitIn(wtPath, mergeArgs, { allowNonZero: true });
         if (result.exitCode !== 0) {
             const conflictFiles = parseConflicts(result.stderr);
             // Lockfile-only conflicts can be auto-resolved by regenerating.

package/dist/github-auth.d.ts

@@ -21,6 +21,7 @@ export interface GitHubAppTokenManager extends RuntimeGitHubAuthProvider {
     start(): Promise<void>;
     stop(): void;
 }
+export declare function resolveAppSlug(credentials: GitHubAppCredentials): Promise<string>;
 export declare function issueGitHubAppToken(credentials: GitHubAppCredentials, options?: {
     repoFullName?: string;
 }): Promise<{

package/dist/github-auth.js

@@ -30,6 +30,11 @@ function githubHeaders(token) {
         "X-GitHub-Api-Version": "2022-11-28",
     };
 }
+export async function resolveAppSlug(credentials) {
+    const jwt = generateJwt(credentials.appId, credentials.privateKey);
+    const data = await fetchJson("https://api.github.com/app", { headers: githubHeaders(jwt) });
+    return data.slug;
+}
 async function resolveInstallationIdForRepo(jwt, repoFullName) {
     const encodedRepo = repoFullName
         .split("/")

package/dist/interfaces.d.ts

@@ -15,7 +15,7 @@ export interface GitOperations {
  */
 export interface SpeculativeBranchBuilder {
     /** Merge prBranch into baseBranch, store result as specName. */
-    buildSpeculative(prBranch: string, baseBranch: string, specName: string): Promise<MergeResult>;
+    buildSpeculative(prBranch: string, baseBranch: string, specName: string, mergeMessage?: string): Promise<MergeResult>;
     /** Delete a speculative branch (cleanup after merge/eviction). */
     deleteSpeculative(specName: string): Promise<void>;
 }
@@ -44,6 +44,12 @@ export interface GitHubPRApi {
     findPRByBranch(branch: string): Promise<number | null>;
     /** Delete the PR's head branch from the remote (best-effort cleanup). */
     deleteBranch(prNumber: number): Promise<void>;
+    /** List open PRs with a specific label (for startup scan). */
+    listOpenPRsWithLabel(label: string): Promise<Array<{
+        number: number;
+        branch: string;
+        headSha: string;
+    }>>;
 }
 /**
  * Reports evictions to external systems. The production implementation

package/dist/reconciler.js

@@ -186,9 +186,11 @@ async function prepareEntry(ctx, entry, isHead, prevEntry) {
     // ── Build spec branch: merge PR into base ─────────────────────
     const specName = specBranchName(entry.id);
     emit(ctx, entry, "spec_build_started", { specBranch: specName, baseSha, ...(prevEntry ? { dependsOn: prevEntry.id } : {}) });
+    const branchSuffix = entry.branch.replace(/^.*\//, "").replace(/-/g, " ");
+    const mergeMessage = `Merge PR #${entry.prNumber}: ${branchSuffix}`;
     let result;
     try {
-        result = await ctx.specBuilder.buildSpeculative(entry.branch, base, specName);
+        result = await ctx.specBuilder.buildSpeculative(entry.branch, base, specName, mergeMessage);
     }
     catch (err) {
         if (isHead) {

package/dist/server.js

@@ -10,18 +10,20 @@ import { buildMultiRepoHttpServer } from "./http-multi.js";
 import { loadAllRepoConfigs } from "./install.js";
 import { parseHomeConfigObject } from "./steward-home.js";
 import { getMergeStewardPathLayout } from "./runtime-paths.js";
-import { createGitHubAppTokenManager, resolveGitHubAuthConfig } from "./github-auth.js";
+import { createGitHubAppTokenManager, resolveGitHubAuthConfig, resolveAppSlug } from "./github-auth.js";
 import { discoverRepoSettings } from "./github-repo-discovery.js";
-import { resolveSecret } from "./resolve-secret.js";
+import { resolveSecret, resolveSecretWithSource } from "./resolve-secret.js";
 import { setRuntimeGitHubAuthProvider } from "./exec.js";
 import { readFileSync, existsSync } from "node:fs";
-async function createRepoInstance(config, logger) {
+async function createRepoInstance(config, logger, botIdentity) {
     const repoUrl = `https://github.com/${config.repoFullName}.git`;
     const clone = new CloneManager(config.clonePath, repoUrl, config.repoFullName, config.gitBin, logger);
     await clone.ensureClone();
     await clone.fetch();
     const store = new SqliteStore(config.database.path);
     const git = new ShellGitOperations(clone.path, config.repoFullName, config.gitBin);
+    if (botIdentity)
+        git.setBotIdentity(botIdentity);
     const ci = new GitHubActionsRunner(config.repoFullName, config.requiredChecks);
     const github = new GitHubPRClient(config.repoFullName);
     const eviction = new GitHubCheckRunReporter(config.repoFullName, config.server.bind, config.server.port, config.server.publicBaseUrl, config.admissionLabel, config.mergeQueueCheckName);
@@ -32,15 +34,21 @@ export async function startMultiServer() {
     const layout = getMergeStewardPathLayout();
     const homeRaw = existsSync(layout.configPath) ? readFileSync(layout.configPath, "utf8") : "{}";
     const home = parseHomeConfigObject(homeRaw, layout.configPath);
-    const webhookSecret = resolveSecret("merge-steward-webhook-secret", "MERGE_STEWARD_WEBHOOK_SECRET");
+    const webhookSecretResolved = resolveSecretWithSource("merge-steward-webhook-secret", "MERGE_STEWARD_WEBHOOK_SECRET");
+    const webhookSecret = webhookSecretResolved.value;
     const bind = home.server.bind;
     const port = home.server.gateway_port ?? (home.server.port_base - 1);
     const publicBaseUrl = home.server.public_base_url;
     const logLevel = home.logging.level;
     const logger = pino({ level: logLevel });
+    logger.info({
+        webhookSecretSource: webhookSecretResolved.source,
+        webhookSecretPrefix: webhookSecret?.slice(0, 4) ?? "NONE",
+    }, "Webhook secret loaded");
     const configs = await loadAllRepoConfigs();
     const githubAuth = resolveGitHubAuthConfig();
     let githubAppTokenManager;
+    let botIdentity;
     let githubRuntimeStatus = {
         mode: "none",
         configured: false,
@@ -64,6 +72,17 @@ export async function startMultiServer() {
         setRuntimeGitHubAuthProvider(githubAppTokenManager);
         try {
             await githubAppTokenManager.start();
+            try {
+                const slug = await resolveAppSlug(githubAuth.credentials);
+                botIdentity = {
+                    name: `${slug}[bot]`,
+                    email: `${githubAuth.credentials.appId}+${slug}[bot]@users.noreply.github.com`,
+                };
+                logger.info({ botName: botIdentity.name }, "Resolved GitHub App bot identity");
+            }
+            catch {
+                logger.warn("Could not resolve GitHub App slug, merge commits will use clone owner identity");
+            }
             githubRuntimeStatus = {
                 ...githubRuntimeStatus,
                 ready: true,
@@ -97,7 +116,7 @@ export async function startMultiServer() {
     const instances = new Map();
     for (const config of configs) {
         logger.info({ repoId: config.repoId, repoFullName: config.repoFullName }, "Initializing repo");
-        const instance = await createRepoInstance(config, logger.child({ repoId: config.repoId }));
+        const instance = await createRepoInstance(config, logger.child({ repoId: config.repoId }), botIdentity);
         instances.set(config.repoFullName, instance);
     }
     const app = await buildMultiRepoHttpServer({
@@ -132,6 +151,6 @@ export async function startMultiServer() {
     await app.listen({ host: bind, port });
     logger.info({ bind, port, repos: instances.size }, "merge-steward listening");
     for (const inst of instances.values()) {
-        inst.service.start();
+        await inst.service.start();
     }
 }

package/dist/service.d.ts

@@ -27,7 +27,7 @@ export declare class MergeStewardService {
     constructor(config: StewardConfig, store: QueueStore, git: GitOperations, ci: CIRunner, github: GitHubPRApi, eviction: EvictionReporter, specBuilder: import("./interfaces.ts").SpeculativeBranchBuilder, logger: Logger);
     /** Expose the GitHub client for webhook handler branch→PR lookups. */
     get githubApi(): GitHubPRApi;
-    start(): void;
+    start(): Promise<void>;
     stop(): Promise<void>;
     enqueue(params: {
         prNumber: number;

package/dist/service.js

@@ -42,9 +42,25 @@ export class MergeStewardService {
     get githubApi() {
         return this.github;
     }
-    start() {
+    async start() {
         this.logger.info({ pollIntervalMs: this.config.pollIntervalMs }, "Steward service starting");
         this.scheduleNextTick();
+        // Best-effort: scan GitHub for PRs with the admission label that
+        // aren't already in the queue (recovers state after restart).
+        try {
+            const labeled = await this.github.listOpenPRsWithLabel(this.config.admissionLabel);
+            let admitted = 0;
+            for (const pr of labeled) {
+                if (await this.tryAdmit(pr.number, pr.branch, pr.headSha))
+                    admitted++;
+            }
+            if (labeled.length > 0) {
+                this.logger.info({ scanned: labeled.length, admitted }, "Startup scan for labeled PRs complete");
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Startup scan for labeled PRs failed");
+        }
     }
     async stop() {
         if (this.tickTimer) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "merge-steward",
-  "version": "0.8.9",
+  "version": "0.8.11",
   "description": "Serial merge queue for GitHub — rebase, CI-gate, and merge PRs one at a time",
   "type": "module",
   "repository": {