Skip to content
Snippets Groups Projects
New look: Off

Find a "merge bot" for managing MRs on gitlab

    • Closed Issue created by Clayton Craft @craftyguy

    We would like to have some sort of merge bot that handles MRs for our instance/projects, similar to margebot on fd.o/Mesa3d.

    Requirements:

    • Bot add MR number/reference to commit message

      • link to merge request or “MR $ID”
      • !$ID is also fine

    • Merge without waiting for CI to pass, have a queue of them!

      • Similar to the "merge train" feature of premium gitlab.com

    • commit signing, so we know for sure it was merged through our infra

      • May not be a requirement if we limit merges to only the merge bot (i.e. if no individuals can merge)

    @caleb and @lucaweiss have looked at marge bot and gitlab-merge-bot. IIUC marge bot was too complicated and required some downstream patching to make it work, and I'm not sure why gitlab-merge-bot was ruled out. (@caleb and @lucaweiss please edit this description with more context/info)

    To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information

    Child items ...

    • Activity

      • David Heidelberg
        David Heidelberg @dh ·

        Just wanted to note that for the Marge-bot, we're open to contributions! If you have any suggested changes, we're happy to discuss them and potentially merge them if they would be beneficial to other projects as well.

        edit: Just with recent MRs we dropped some legacy code, so... hope it'll be more convincing now :wink:

        Edited by David Heidelberg
      • Luca Weiss
        Luca Weiss @lucaweiss ·
        Maintainer

        When we tried Marge-bot recently there were two big problems:

        1. While testing merging failed very often with some obscure error. According to some issue report from around 2020 this should've been solved long ago, iirc it was something supposedly only affecting repos without pipelines?
        2. The messages printed by Marge (both in log and on gitlab) are quite bad, very often they don't seem to help at all, and would be in our opinion better if it said something like "Due to foo bar this MR couldn't be merged" instead of "oh my god, I couldn't merge this, your problem now"

        And also (this is still under discussion) there's no functionality for the bot to sign commits before merging them to master - sort of a stamp of approval that the commit was actually merged by marge and not someone pretending to be marge.

      • David Heidelberg
        David Heidelberg @dh ·

        Sorry for late response, traveling so my backlog grows a bit :cry: . Back to the business:

        1. I would need to get more info what happened, eventually link to the bug report

        2. yes, we trying to improve them (sometimes getting "something went wrong isn't really useful for anyone, but for us, Mesa3D, it happends very rarely - as once a month)

        3. The signing, there is currently no open issue or interest in it except pmOS. Practically, signing verify the author, where

        • Marge cannot keep the signature because of altering the commit
        • only reason would be proving the Marge did the push, but in the end people allowed trigger marge are the same ones with the ability to hit Merge button, so it would be useful to know rationale behind this feature requirement
      • Clayton Craft
        Clayton Craft @craftyguy ·
        Author Maintainer
        1. The signing, there is currently no open issue or interest in it except pmOS. Practically, signing verify the author, where
        • only reason would be proving the Marge did the push, but in the end people allowed trigger marge are the same ones with the ability to hit Merge button, so it would be useful to know rationale behind this feature requirement

        I'm one of those who keeps saying we should keep commit signing. The way we currently merge stuff in gitlab requires one of us to rebase/resign before clicking on the 'merge' UI button. It means anyone can verify that changes made in the OS were verified by a pmOS developer. By using a merge bot, we can no longer verify this since the bot will need to rebase/ff/modify commits (so developer sig. no longer applies). I mean, at best we could verify the bot signature as you pointed out, but it doesn't necessarily mean a pmOS developer verified it and IMHO that was the original reason for signing commits. So I think you're right, there may be no point to continuing to sign commits since we've already decided we want a merge bot thing, and there's not really much benefit since the original reason for signing is broken/invalid regardless.

      • Please register or sign in to reply
    • Raymond Hackley added help wanted label

      added help wanted label

    • Pablo Correa Gomez
      Pablo Correa Gomez @pabloyoyoista ·
      Maintainer

      This is currently WIP on the infra side. All the blockers to use "marge" as merge bot have been solved with https://gitlab.com/marge-org/marge-bot/-/merge_requests/518 and https://gitlab.com/marge-org/marge-bot/-/merge_requests/534

    • Pablo Correa Gomez closed

      closed

    Please register or sign in to reply