ci: fast-forward bump PRs as the release app instead of waiting for a human merge

[devin-ai-integration]

Summary

scripts/bump_package.py opened the bump PR, armed auto-merge, asked for a squash merge, then polled up to 1800s for the PR to merge and died with the tag stranded. The require-review ruleset lists the release app as a bypass actor, but GitHub only honours app bypass on direct ref updates, never on the merge API or auto-merge, so neither path could ever land the PR without a human. Two manual tag recoveries this week.

The app-performed direct ref update is now the primary, deliberate merge path, sequenced so the incident-class protections from #253 stay intact (tag only after a verified merge, scoped bump detection and NO_COMMITS_FOUND handling untouched, recover_untagged_bump still covers a run that dies between merge and tag):

bump_package():
    ... cz bump, remote branch at parent_sha, signed commit, create_bump_pr (unchanged, minus auto-merge arming)
    merge_sha = merge_bump_pr(repo, pr, branch, target, parent_sha, files, headline, body)
    if merge_sha is None: fail loudly, no tag
    create_and_push_tag(repo, tag, merge_sha)

merge_bump_pr():                       # up to 3 rounds
    head = wait_for_checks(pr)          # SUCCESS -> head sha; FAILURE/CLOSED/timeout(1200s) -> None
    live = get_live_branch_sha(target)  # GET repos/{repo}/git/ref/heads/{target}
    if live != base_sha:                # strict fast-forward guard
        rebase_bump_branch(...)         # refuses if target's new commits touched the bumped files,
        base_sha = live; continue       # else moves the *bump branch* to live and re-creates the signed commit
    fast_forward_target(target, head)   # PATCH repos/{repo}/git/refs/heads/{target} sha=head, never force
    return verify_pr_merged(pr, head)   # MERGED with mergeCommit.oid == head within 120s, else None

checks_verdict replaces checks_green: FAILURE beats PENDING, so one red check aborts even while others still run; pending never passes. The fast-forward log line states the ref update was performed by the release app under its ruleset bypass, so an auditor understands why no review appears on the PR.

Auto-merge arming was dropped: with the app doing the merge it only adds a race where a squash merge could land first and turn the fast-forward into a spurious non-FF refusal.

.github/workflows/bump-package.yml is unchanged. The app installation token already needs contents write (it creates tag refs and the bump branch today) and pull-requests write; the fast-forward is another refs write under the same permission, so no additional permission is required.

Tests (python3 -m unittest discover -s scripts -p 'test_*.py', 28 pass with commitizen installed): strict-FF guard refuses when the target moved and never touches the refs API; the FF PATCH carries no force; rebuild refuses when the target changed bumped files; tag is unreachable when verify_pr_merged returns None; checks gate refuses on FAILURE and times out on PENDING without opening the merge path.

Link to Devin session: https://app.devin.ai/sessions/52b1004809294cdaa25c036b6c644e7f
Open in Devin Desktop: https://app.devin.ai/desktop/session/52b1004809294cdaa25c036b6c644e7f?variant=devin
Requested by: @Larry-Osakwe

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[Larry-Osakwe]

Reviewed as release infrastructure: the checks gate fails closed on empty rollups, the fast-forward is strict with the non-force PATCH as the TOCTOU backstop, the tag is unreachable without a verified merge, and all four lived failure modes (5am hands-off, human merge mid-wait, failed checks, moved main) end clean. Five mutation checks caught, 42 script tests green.