Skip to content

merge queue: checking main (b723ac5) and #12204 together#12221

Closed
mergify[bot] wants to merge 2 commits into
mainfrom
mergify/merge-queue/1f96025663
Closed

merge queue: checking main (b723ac5) and #12204 together#12221
mergify[bot] wants to merge 2 commits into
mainfrom
mergify/merge-queue/1f96025663

Conversation

@mergify

@mergify mergify Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🎉 This pull request has been checked successfully and will be merged soon. 🎉

Branch main (b723ac5) and #12204 are queued together for merge.

This pull request has been created by Mergify to check the mergeability of #12204.
You don't need to do anything. Mergify will close this pull request automatically when it is complete.

Required conditions of queue rule default for merge:

Required conditions to stay in the queue:

---
checking_base_sha: b723ac5ca4845d580fc90e9f10c10a0398b88d1f
previous_check_retries: []
previous_failed_batches: []
pull_requests:
  - number: 12204
    scopes: []
scopes: []
...

jd and others added 2 commits July 26, 2026 13:22
@jd
feat(agents): stop agents leaking internal information into published…
519cdbc 
… docs

Docs are usually written *from* internal material: a support case, a private
PR, an engine source file, a Linear ticket. That material travels with the
draft, and nothing in the repo told an agent to leave it behind. A recent
billing page was written from a support ticket whose context carried a
helpdesk ticket ID, a thread ID, a customer org name, and a private
shadow-office source path. None of that belongs on docs.mergify.com, and a
leaked identifier cannot be unpublished.

This follows the repo's existing agent-guidance structure rather than adding
a parallel document:

- **AGENTS.md** gains Critical Rule 8 plus a "Never Publish Internal
  Information" section listing concretely what must never ship (ticket and
  thread IDs, customer/org/account identifiers, private repo and source
  paths, internal trackers and admin URLs, credentials, internal framing),
  and how to fix a leak: state the behavior, drop the provenance.

- **`proofread-leaks`** joins the proofread pipeline as a 5th subagent,
  written to match the existing proofread-* skills. It is the one
  proofreader that never skips: the pipeline's 10-line threshold and its
  "code blocks only" / "frontmatter only" exemptions are exactly where a
  one-line ticket ID hides, so those exemptions no longer apply to it.

- **`pnpm check:internal-leaks`** (`scripts/check-internal-leaks.mjs`, plus a
  CI job) is the deterministic backstop, modelled on
  validate-config-examples: fixed patterns for ticket/thread IDs, private
  repo and source paths, and internal trackers and hostnames, with a
  per-line `internal-leaks: allow <rule>` escape hatch.

- **docs-from-code**, **docs-gap-analysis**, and **document-a-feature** each
  gain a pointer, since those are the skills that pull internal material in.

Every rule is narrow enough to leave today's docs clean (146 files scanned,
0 findings) and to ignore the placeholders the docs already use, so `ghp_*`,
`<your-token>`, `Mergifyio/mergify`, and `app.datadoghq.com` do not fire.

Credentials stay in the policy and in proofread-leaks' checklist, but the
deterministic scan does not look for them: secret detection is not this
script's job to reinvent.

Judgment call worth a look: the ask was for instructions, and the CI scanner
goes beyond that. I added it because the skill-level check only fires when
an agent runs the pipeline, which leaves human edits and skipped passes
uncovered, and because this is the one class of mistake that is unfixable
after the fact. Happy to drop the script and keep the instructions if you
would rather not carry the CI surface.

The scanner cannot catch customer names, copied examples, or internal
framing. That half stays with proofread-leaks, and the docs say so in both
places so a green CI run is not mistaken for a clean bill of health.

Change-Id: I56a581e7825816dbdc7e7f9be082f39d799cd72f
@mergify
Merge of #12204
1016b88
@mergify
mergify Bot deployed to Mergify Merge Protections July 27, 2026 07:34 Active
@mergify mergify Bot mentioned this pull request Jul 27, 2026
Merged
@mergify mergify Bot closed this Jul 27, 2026
@mergify
mergify Bot deleted the mergify/merge-queue/1f96025663 branch July 27, 2026 07:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jd