Merge branch 'main' into fix/rows-err-instructions-resolve

The Resolve handler and scanInstructions both had rows.Next() loops
without a rows.Err() check. Without rows.Err(), a database scan error
(e.g. connection drop mid-stream) is silently swallowed and the handler
returns a truncated result with HTTP 200 — a data-integrity gap.

Fixes:
- Resolve: rows.Err() check after loop, logs workspaceID + error
- scanInstructions: adds Err() error to interface constraint and rows.Err()
  check after loop

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/scripts/gitea-merge-queue.py

@@ -314,29 +314,6 @@ def post_comment(pr_number: int, body: str, *, dry_run: bool) -> None:
     api("POST", f"/repos/{OWNER}/{NAME}/issues/{pr_number}/comments", body={"body": body})
 
 
-def remove_label(pr_number: int, label: str, *, dry_run: bool) -> None:
-    print(f"::notice::removing label '{label}' from PR #{pr_number}")
-    if dry_run:
-        return
-    # Gitea requires label ID, not name, for deletion.
-    # Multiple labels can share the same name with different IDs — remove all.
-    _, body = api("GET", f"/repos/{OWNER}/{NAME}/pulls/{pr_number}")
-    pr_labels = body.get("labels", []) if isinstance(body, dict) else []
-    removed = False
-    for lbl in pr_labels:
-        if lbl.get("name") == label:
-            label_id = lbl.get("id")
-            if label_id:
-                api(
-                    "DELETE",
-                    f"/repos/{OWNER}/{NAME}/issues/{pr_number}/labels/{label_id}",
-                    expect_json=False,
-                )
-                removed = True
-    if not removed:
-        print(f"::notice::label '{label}' not found on PR #{pr_number}")
-
-
 def update_pull(pr_number: int, *, dry_run: bool) -> None:
     print(f"::notice::updating PR #{pr_number} with base branch via style={UPDATE_STYLE}")
     if dry_run:
@@ -430,30 +407,7 @@ def process_once(*, dry_run: bool = False) -> int:
                 "deferring to next tick"
             )
             return 0
-        try:
-            merge_pull(pr_number, dry_run=dry_run)
-        except ApiError as exc:
-            # Merge failed (pre-receive hook, branch protection, etc.).
-            # Remove queue label so next tick picks the next PR.
-            msg = str(exc)
-            if "405" in msg or "not allowed to merge" in msg.lower():
-                hint = "pre-receive hook or branch protection blocked the merge"
-            elif "422" in msg or "Unprocessable" in msg:
-                hint = "branch protection required-status check failed"
-            elif "409" in msg or "conflict" in msg.lower():
-                hint = "merge conflict"
-            else:
-                hint = msg[:200]
-            remove_label(pr_number, QUEUE_LABEL, dry_run=dry_run)
-            post_comment(
-                pr_number,
-                (
-                    f"merge-queue: merge blocked ({hint}). "
-                    f"Label removed — re-add once the block is resolved."
-                ),
-                dry_run=dry_run,
-            )
-            return 0
+        merge_pull(pr_number, dry_run=dry_run)
         return 0
     return 0
 

.gitea/workflows/gitea-merge-queue.yml

@@ -48,12 +48,6 @@ jobs:
           REQUIRED_CONTEXTS: >-
             CI / all-required (pull_request),
             sop-checklist / all-items-acked (pull_request)
-          # NOTE: qa-review / security-review gates intentionally omitted.
-          # These gates permanently fail (mc#1111: SOP_TIER_CHECK_TOKEN missing
-          # PAT — token owner not in qa/security teams). Adding them to
-          # REQUIRED_CONTEXTS would strip the merge-queue label from every PR
-          # in the queue, breaking the queue for all contributors.
-          # Re-add these gates once mc#1111 is resolved.
           # Push-side required contexts. Checking CI / all-required (push)
           # explicitly instead of the combined state avoids false-pause when
           # non-blocking jobs (continue-on-error: true) have failed — those

workspace-server/internal/handlers/instructions.go

@@ -248,6 +248,9 @@ func (h *InstructionsHandler) Resolve(c *gin.Context) {
 		b.WriteString(content)
 		b.WriteString("\n\n")
 	}
+	if rowsErr := rows.Err(); rowsErr != nil {
+		log.Printf("ResolveInstructions rows.Err workspace=%s: %v", workspaceID, rowsErr)
+	}
 
 	c.JSON(http.StatusOK, gin.H{
 		"workspace_id": workspaceID,
@@ -258,6 +261,7 @@ func (h *InstructionsHandler) Resolve(c *gin.Context) {
 func scanInstructions(rows interface {
 	Next() bool
 	Scan(dest ...interface{}) error
+	Err() error
 }) []Instruction {
 	var instructions []Instruction
 	for rows.Next() {
@@ -269,6 +273,9 @@ func scanInstructions(rows interface {
 		}
 		instructions = append(instructions, inst)
 	}
+	if scanErr := rows.Err(); scanErr != nil {
+		log.Printf("scanInstructions rows.Err: %v", scanErr)
+	}
 	if instructions == nil {
 		instructions = []Instruction{}
 	}