fix(ci): repair auto-merge critical-infra gate (missing grep -E) + defense-in-depth label gate

[axeII]

The bug

auto-merge.yaml:150 uses grep -qi (Basic Regex) against a pattern containing |:

MANUAL_TITLE_REGEX="ceph|cilium|flux|dragonfly"
...
grep -qi "${MANUAL_TITLE_REGEX}"  # | is LITERAL in BRE — never matches

With BRE, | is a literal character. The pattern only matches the exact string ceph|cilium|flux|dragonfly → the manual-infra filter has been dead since July 6, 2026 (commit 2a83d1a96 introduced the first |).

For contrast, every other workflow with a similar pattern uses -E correctly:

• pr-classify.yaml:70 — grep -qiE ✓
• bulk-merge-prs.yaml:51 — grep -qiE ✓

What slipped through

All merged by bot-akira[bot] when they should have been manual:

PR	What	When	Severity
#3706	rook-ceph v1.20.2→v1.20.3 (patch)	Today 05:36Z	⚠️ manual per policy
#3705	rook/ceph image v1.20.2→v1.20.3 (patch)	Today 05:41Z	⚠️ manual per policy
#3701	flux-operator 0.55→0.57 (minor)	Today 06:07Z	🚨 minor GitOps-core auto-merged
#3675	flux distribution v2.9.2→v2.9.3 (patch)	Jul 26	⚠️ "fluxcd" contains "flux"

No actual damage this time — rook-ceph healthy at v1.20.3, flux-operator 0.57.0 healthy, cluster reconciling normally. But the policy hole was real: titles like "update cilium chart 1.19→1.20" would have merged Friday at the next release-train window.

Fix

1. Line 150: grep -qi → grep -qiE — makes ceph|cilium|flux|dragonfly work as alternation.

2. New needs-review label gate (lines 156-161): auto-merge now hard-skips any PR labeled needs-review (set correctly by pr-classify with a working -E regex). This is defense in depth — two independent detection layers must both fail for a critical-infra PR to auto-merge.

3. AGENTS.md: Updated the auto-merge policy table ("critical infra" row matches the runtime regex + label gate) and added a defense-in-depth bullet.

Proof

Before fix — dead filter (no match):

$ echo "fix(container): update rook-ceph group (v1.20.2 → v1.20.3)" | grep -qi "ceph|cilium|flux|dragonfly"
$ echo $?
1  # no match — would have auto-merged

After fix — working:

$ echo "fix(container): update rook-ceph group (v1.20.2 → v1.20.3)" | grep -qiE "ceph|cilium|flux|dragonfly"
$ echo $?
0  # match — skipped as manual ✓

Blast radius

• .github/workflows/auto-merge.yaml — CI-only, no cluster impact
• AGENTS.md — docs
• README.md — trailing-whitespace cleanup (pre-commit auto-fix)

⏰ Deadline

Merge before Fri Aug 7 ~02:00 UTC — PR #3709 (cilium 1.19.6→1.20.0, minor, risk/critical) becomes age-eligible then and would auto-merge if the gate is still broken. (PR #3655, ceph v20→v21 major, is blocked by the major rule and safe regardless.)

[bot-akira]

konflate — summary

Note

✅ No rendered changes.

View the full rendered diff →

_{konflate · rendered 8b9b98f · advisory, not a gate}