security: remove the force_merge / --admin CI-override merge path #480

New issue

Closed

opened 2026-09-10 22:32:32 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-10 22:32:32 +00:00

Owner

madtea must never let an agent merge a PR past a red or pending required status check. The green gate is authoritative.

Today one surface breaks that rule. madt_prs action=merge takes force_merge, and madtea pr merge takes --admin. Both set gitea.MergePROptions.ForceMerge, which sends force_merge: true in the merge payload. The forge then merges even if the required checks have not passed.

Remove this override from every surface. Keep the safe paths: a normal merge still merges, and auto_merge still schedules an auto-merge on green (#438, #464).

Change

MCP: drop the force_merge arg from madt_prs action=merge - the input struct field, the action Optional list, the summary, the paramdocs entry, and the drift keywords.
CLI: drop the --admin flag from madtea pr merge.
Client: drop MergePROptions.ForceMerge and the force_merge payload key.
Docs: drop --admin from docs/COMPARISON.md, regenerate the reference docs, and update the agent-onboarding drift row.

Acceptance

No madtea surface (MCP arg, CLI flag, client option) can send force_merge.
A guard test proves the merge payload never carries a force_merge key, whatever the options.
A normal merge and auto_merge (wait-for-green) still work unchanged.
./scripts/gate.sh passes clean: gofmt, vet, staticcheck, parity, drift, and docs-generate.

This is a breaking change. It removes a public CLI flag and a public MCP arg.

madtea must never let an agent merge a PR past a red or pending required status check. The green gate is authoritative. Today one surface breaks that rule. `madt_prs action=merge` takes `force_merge`, and `madtea pr merge` takes `--admin`. Both set `gitea.MergePROptions.ForceMerge`, which sends `force_merge: true` in the merge payload. The forge then merges even if the required checks have not passed. Remove this override from every surface. Keep the safe paths: a normal merge still merges, and `auto_merge` still schedules an auto-merge on green (#438, #464). ## Change - MCP: drop the `force_merge` arg from `madt_prs action=merge` - the input struct field, the action Optional list, the summary, the paramdocs entry, and the drift keywords. - CLI: drop the `--admin` flag from `madtea pr merge`. - Client: drop `MergePROptions.ForceMerge` and the `force_merge` payload key. - Docs: drop `--admin` from `docs/COMPARISON.md`, regenerate the reference docs, and update the agent-onboarding drift row. ## Acceptance - No madtea surface (MCP arg, CLI flag, client option) can send `force_merge`. - A guard test proves the merge payload never carries a `force_merge` key, whatever the options. - A normal merge and `auto_merge` (wait-for-green) still work unchanged. - `./scripts/gate.sh` passes clean: gofmt, vet, staticcheck, parity, drift, and docs-generate. This is a breaking change. It removes a public CLI flag and a public MCP arg.

hexajon added the

breaking

security

labels

2026-09-10 22:32:32 +00:00

hexajon referenced this issue from a pull request that will close it,

2026-09-10 22:43:37 +00:00

feat(prs)!: remove force_merge/--admin, madtea never overrides required CI checks #481

hexajon referenced this issue from a commit

2026-09-10 22:43:38 +00:00

feat(prs)!: remove force_merge/--admin, madtea never overrides required CI checks

hexajon closed this issue