.github/workflows/ci-checker.yml (7)

14-14: Normalize runner label to canonical value.

GitHub docs use ubuntu-latest (lowercase). While labels may be case-insensitive, standardizing reduces surprises and avoids linter noise.

Apply this diff:

-    runs-on: Ubuntu-Latest
+    runs-on: ubuntu-latest

…and likewise for the second job:

-    runs-on: Ubuntu-Latest
+    runs-on: ubuntu-latest

Also applies to: 32-32

---

11-15: Gatekeeper job may need pull-requests: read.

Some gatekeeper actions inspect PR metadata (draft state, reviews, etc.). If upsidr/merge-gatekeeper needs PR context, add pull-requests: read to avoid permission denials under the workflow’s restrictive defaults.

Proposed change:

     permissions:
       checks: read
       statuses: read
+      pull-requests: read

If unnecessary, feel free to skip—just flagging in case the action relies on PR fields.

---

15-15: Gatekeeper timeout may be too short.

If your CI regularly exceeds 10 minutes, the gatekeeper can time out before all checks settle. Consider 20–30 minutes to be safe.

-    timeout-minutes: 10
+    timeout-minutes: 30

---

25-33: Auto-merge guardrail improvements (draft, teams, base branch).

The current if: misses team reviewers and draft status, and doesn’t constrain the base branch. Recommend tightening to avoid premature merges.

Apply this diff:

-    if: ${{ github.event.pull_request.user.login == 'renovate[bot]' && github.event.sender.login == 'autofix-ci[bot]' && toJson(github.event.pull_request.requested_reviewers) == '[]' }}
+    if: ${{ 
+      github.event.pull_request.user.login == 'renovate[bot]' &&
+      github.event.pull_request.base.ref == 'main' &&
+      github.event.pull_request.draft == false &&
+      length(github.event.pull_request.requested_reviewers) == 0 &&
+      length(github.event.pull_request.requested_teams) == 0 &&
+      (github.event.sender.login == 'autofix-ci[bot]' || github.event.sender.login == 'renovate[bot]')
+    }}

If you intentionally want to trigger only on autofix-ci[bot] events, keep that part as-is—just add the draft/teams/base checks.

---

33-33: Increase merge step timeout.

Merges plus branch deletion can exceed 60 seconds during API lag; suggest a small buffer.

-    timeout-minutes: 1
+    timeout-minutes: 5

---

35-39: Prefer merging by PR number and delete the branch post-merge.

Using GITHUB_HEAD_REF can be ambiguous for forks; merging by PR number is unambiguous. Deleting the head branch keeps things tidy.

-      - name: 🔀 Squash merge PR
-        run: gh pr merge --repo="$GITHUB_REPOSITORY" "$GITHUB_HEAD_REF" --squash
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: 🔀 Squash merge PR
+        run: gh pr merge --repo "$GITHUB_REPOSITORY" ${{ github.event.pull_request.number }} --squash --delete-branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Optionally add --auto if you want GH to wait for checks itself and merge when ready (gatekeeper already enforces this, so not strictly needed).

---

3-5: Add workflow concurrency to prevent duplicate merges.

If multiple PR events fire close together (e.g., synchronize + label), you can serialize runs per-PR to avoid racing the merge.

 on:
   pull_request:
 
+concurrency:
+  group: ci-checker-pr-${{ github.event.pull_request.number }}
+  cancel-in-progress: true

If you prefer job-scoped concurrency, add the same block under the merge-pr job instead.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.