ci: only read the Depends on lines, and let the label be the gate

This commit is contained in:
Lunny Xiao
2026-09-08 12:03:59 -07:00
parent 83cbd0138f
commit fecad73221
3 changed files with 78 additions and 26 deletions
+17 -6
View File
@@ -52,23 +52,34 @@ group from the `_category_.json` of its directory.
A page that describes a gitea change which is not merged yet must wait for it,
otherwise the site documents something no release has. Say so in the description
of the pull request:
of the pull request, on a line of its own, and add the `depends-on-upstream`
label:
```
Depends on: gitea#35851
```
The `depends-upstream` check reads those references (`gitea#<id>` or the full
pull request url, several are allowed) and fails while any of them is unmerged,
which blocks the merge since `main` requires the `checks` contexts. Add the
`depends-on-upstream` label as well, so the pull request is easy to find; the
label alone fails the check, it has to be accompanied by a reference.
The label is what blocks the merge: the `depends-upstream` check fails while it
is set, unless every dependency is verified as merged, and `main` requires the
`checks` contexts. The check reads the `Depends on:` lines (`gitea#<id>` or the
full pull request url, several lines are allowed) to find out what to wait for,
so the label needs at least one of them. A `gitea#<id>` mentioned anywhere else
in the description is ignored.
Without the label, a dependency that the check finds unmerged still fails it, so
forgetting the label does not let an unreleased feature through.
The `unlabel merged upstream dependencies` job runs every 6 hours, removes the
label once every referenced pull request is merged and comments on the pull
request, which reruns the check. `scripts/check-upstream-deps.sh` is the check
itself and can be run locally against the json of a pull request.
The check asks the github api whether a pull request is merged, and the runners
share the 60 requests per hour it allows without authentication. The optional
`GITHUB_COM_TOKEN` secret (a token without scopes is enough) raises that limit;
without it an unverifiable dependency only fails the check when the label is
set.
## Cutting a version
```shell