gitea: mesh/check is the mesh's own status and never blocks; signed commits, an outdated branch and a rejected review are said as blocking the mesh's merge (issue 1945, review round 2)

modules/gitea/test/tools-account.test.ts

@@ -660,7 +660,8 @@ test("the merging account is given write on each repository the indexer's module
   // The operator's rule is left as set (the operator, 2026-10-26: "Write, rule untouched"): only mesh-tools is added to its
   // merge whitelist; a status the mesh does not set and required approvals are said as blocking the mesh's merge, unchanged.
   const operators = { rule_name: "main", enable_push: true, enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"],
-    enable_status_check: true, status_check_contexts: ["mesh/merge-gate", "ci/external"], required_approvals: 2, block_admin_merge_override: false };
+    enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "ci/external"], required_approvals: 2,
+    block_admin_merge_override: false, require_signed_commits: true, block_on_outdated_branch: true, block_on_rejected_reviews: true };
   userRules.set("jschoubben/snake", structuredClone(operators));
   const after = await grantTool.run({ repositories: ["jschoubben/snake"] }) as any;
   assert.deepEqual(after.granted, ["jschoubben/snake"]);
@@ -668,13 +669,20 @@ test("the merging account is given write on each repository the indexer's module
   assert.deepEqual(userRules.get("jschoubben/snake"), { ...operators, merge_whitelist_usernames: ["jschoubben", TOOLS_ACCOUNT] }, "only the whitelist changed");
   assert.deepEqual(after.merge_whitelist, [{ repository: "jschoubben/snake", changed: true, listed: ["jschoubben", TOOLS_ACCOUNT] }]);
   const blockedWhy = "writable, but main's rule blocks the mesh's merge: it requires the status ci/external, which the mesh does not set; " +
-    "it requires 2 approving reviews on the forge, which the gate does not give";
+    "it requires 2 approving reviews on the forge, which the gate does not give; it requires signed commits, which the mesh does not make; " +
+    "it refuses a branch behind main, which the mesh does not bring up to date; " +
+    "it refuses a merge after a review asked for changes, which the gate does not clear";
   assert.deepEqual(after.merge_blocked, [{ repository: "jschoubben/snake", why: blockedWhy }]);
   const again = await unwritableTool.run({}) as any;
   assert.deepEqual([again.unwritable, again.merge_blocked], [[], [{ repository: "jschoubben/snake", why: blockedWhy }]]);
   const writesBefore = forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length;
   assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_whitelist[0].changed, false);
   assert.equal(forge.calls.filter((c) => /^PATCH .*branch_protections/.test(c)).length, writesBefore, "a listed account is not written again");
+  // The mesh's own statuses never block: a rule requiring only them, with mesh-tools listed, is not reported.
+  userRules.set("jschoubben/snake", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: [TOOLS_ACCOUNT],
+    enable_status_check: true, status_check_contexts: ["mesh/check", "mesh/merge-gate", "mesh/repo-check"] });
+  assert.deepEqual(((await unwritableTool.run({})) as any).merge_blocked, []);
+  assert.deepEqual(((await grantTool.run({ repositories: ["jschoubben/snake"] })) as any).merge_blocked, []);
   // The forge drops a whitelist login that cannot write and still answers 200: the whitelist is read back and that fails loud.
   userRules.set("jschoubben/dotfiles", { rule_name: "main", enable_merge_whitelist: true, merge_whitelist_usernames: ["jschoubben"] });
   await assert.rejects(GiteaAdmin.fromEnv(env).ensureMergerListed("jschoubben", "dotfiles", TOOLS_ACCOUNT),

modules/gitea/writes.ts

@@ -29,7 +29,7 @@
 
 import type { ForgeRepository } from "./client.js";
 import type { BranchProtection } from "./protection.js";
-import { CHECK_CONTEXT, REPO_CHECK_CONTEXT } from "./pulls.js";
+import { CHECK_CONTEXT, CHECK_STATUS, REPO_CHECK_CONTEXT } from "./pulls.js";
 
 /** The indexer's state this module reads: one key per registered module, its value naming the repository. */
 export const INDEXER_MODULES = "mesh-delivery-indexer.modules";
@@ -47,7 +47,7 @@ export interface WriteForge {
 }
 
 /** The statuses every pull request the mesh delivers carries (mesh-delivery's checks); a rule requiring another blocks. */
-const MESH_CONTEXTS = new Set([CHECK_CONTEXT, REPO_CHECK_CONTEXT]);
+const MESH_CONTEXTS = new Set([CHECK_STATUS, CHECK_CONTEXT, REPO_CHECK_CONTEXT]);
 
 /** What in main's rule stops the mesh's merge, in words; empty when nothing does. Changed by nobody here: the operator's. */
 export function mergeBlocks(rule: BranchProtection | null, account: string): string[] {
@@ -63,6 +63,9 @@ export function mergeBlocks(rule: BranchProtection | null, account: string): str
   }
   const approvals = Number(rule.required_approvals ?? 0);
   if (approvals > 0) blocks.push(`it requires ${approvals} approving review${approvals === 1 ? "" : "s"} on the forge, which the gate does not give`);
+  if (rule.require_signed_commits === true) blocks.push("it requires signed commits, which the mesh does not make");
+  if (rule.block_on_outdated_branch === true) blocks.push("it refuses a branch behind main, which the mesh does not bring up to date");
+  if (rule.block_on_rejected_reviews === true) blocks.push("it refuses a merge after a review asked for changes, which the gate does not clear");
   return blocks;
 }