Compose a PRView SourceOpen Issue

Synced from Hive. This page is pulled from hivecommons/hive@v5 during the docs build. Edit the canonical source in the Hive repository.

ADR-0023: Hive may merge PRs whose author could merge them

Status: Accepted

Terms: Prow is repository automation; Tide is its merge controller. Same-head means approval/check evidence matches the exact commit being merged. SHA pinning checks that commit ID again before merging. Metadata contexts report workflow bookkeeping, not evidence that tests ran.

Context

Hive already has two auto-merge routes. The queued route requires a distinct trusted merger to queue another author’s PR, and the self-authored route lets the App land its own CI-green PRs because Prow/tide cannot accept self-approval. That left human-authored maintainer PRs in a gap: a maintainer can merge their own green PR in GitHub, but Hive would not do it unless a second person added tide’s lgtm and approved signals.

Decision

Add an opt-in auto_merge.trusted_authors tier.

Author admission requires all of:

  • the operator enabled the tier;
  • the PR author holds the configured authorized_users role (merger by default, or owner);
  • GitHub reports repo write/maintain/admin permission, unless the operator explicitly disables that API check. Permission errors fail closed.

Fork PRs still require a positive permission check, so non-member forks never merge through this path.

Merge checks remain separate from admission:

  • required CI green and a mergeable state;
  • no hold/exempt/excluded labels and no outstanding CHANGES_REQUESTED review;
  • expected-head-SHA pinning immediately before merge;
  • the same merge method selection as hive-merge;
  • the enforcing swarm-review gate, when configured, as described in Running at Level 6.

If the base branch’s required-check set is unknown or empty/unprotected, metadata contexts such as Prow tide and probot DCO are not treated as CI evidence or blockers; Hive still requires at least one real successful check-run on the head SHA before trying the server-side merge. Each merge records tier=trusted-author and comments with the author’s role, GitHub permission, and green head SHA.

Consequences

Hive can land green maintainer-authored PRs without waiting for a second human approval signal, but only when the author already has the right to perform that merge. The security argument is therefore no-escalation: Hive acts as an audited executor for a maintainer’s existing repository authority, not as a way for arbitrary PR authors to gain merge power. Operators who do not enable the block get byte-identical behavior.