[rishitank]

Why

Merged PR branches pile up. GitHub has no account-wide setting to delete them: "Automatically delete head branches" is a per-repository toggle, and it deletes every merged head branch with no exceptions. Private repositories on the Free plan can't protect branches, so that toggle could delete a long-lived branch such as develop the first time it is merged as a PR head.

This workflow does the cleanup with an explicit allowlist instead.

What changed

• New .github/workflows/branch-cleanup.yml. Self-contained, no reusable workflow (rishitank/.github main is ruleset-blocked, so a shared copy can't land yet).
  • Trigger: pull_request closed. The one job runs only when the PR was merged and its head is in this repository (never a fork's branch).
  • Keeps the head branch, with a ::notice::, when it is the default branch, or one of main, master, develop, staging, test, gh-pages, deploy-*, release/*, or when any open PR still uses it as its base.
  • Otherwise deletes it with gh api -X DELETE repos/$REPO/git/refs/heads/<ref>, the ref URL-encoded with jq @uri. "Reference does not exist" (422) or a 404 counts as success, since the branch is already gone.
  • Permissions: workflow default {}; the job gets contents: write (delete the ref) and pull-requests: read (the open-PR check). timeout-minutes: 2.
  • No ${{ }} in run:. Every event value reaches the shell through env: and is quoted.
• Checked locally: actionlint and shellcheck are clean. The script was run against a stub gh for the default branch, each allowlisted name, a branch with open child PRs, a ref containing /, a space and #, an already-deleted ref (422 and 404), and a 403, which fails the job.
• The live proof is ci: delete a PR's head branch after it merges, with an allowlist test#15: merging it should delete its own ci/branch-cleanup branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c2510ca1-1074-4c05-a5a6-1509fcce16c3

📥 Commits

Reviewing files that changed from the base of the PR and between ad5eca8 and 1702916.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 323380a9-81f0-4b51-b6a6-c8d622045334

📥 Commits

Reviewing files that changed from the base of the PR and between 0692056 and ad5eca8.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: security / Vulnerable dependencies
• GitHub Check: security / Ecosystem audit
• GitHub Check: build-and-test
• GitHub Check: semantic-release dry-run

🧰 Additional context used

🪛 zizmor (1.30.1)

.github/workflows/branch-cleanup.yml

[warning] 30-30: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

---

[info] 25-25: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

---

[warning] 18-20: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

🔇 Additional comments (1)

.github/workflows/branch-cleanup.yml (1)

60-68: 🎯 Functional Correctness

The encoded-ref concern remains undecided, Apprentice.

The GitHub documentation shows a literal heads/feature/foo path, but it does not state whether DELETE /git/refs/... accepts %2F. The workflow would treat a matching 404 as success, but the required GitHub routing behaviour is not established.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Automatically deletes merged pull-request branches when they’re no longer needed, while preserving protected branches and branches used by open pull requests.

Walkthrough

This change adds a workflow that runs after a pull request closes. For merged pull requests from the same repository, it preserves specified branches and branches used as bases by open pull requests. It deletes other head branches and reports missing branches separately from other deletion errors.

Changes

Pull request branch cleanup

Layer / File(s)	Summary
Workflow trigger and permissions .github/workflows/branch-cleanup.yml	The workflow runs for merged pull requests with same-repository heads. It passes the head ref, default branch, repository and token to the deletion step.
Branch preservation and deletion .github/workflows/branch-cleanup.yml	The deletion logic preserves the default branch, named long-lived branches, matching deploy-* and release/* branches, and branches used as bases by open pull requests. It treats a missing branch or HTTP 404 as a notice and fails on other API errors.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant PullRequestEvent
  participant BranchCleanupWorkflow
  participant GitHubAPI
  PullRequestEvent->>BranchCleanupWorkflow: Trigger when a pull request closes
  BranchCleanupWorkflow->>BranchCleanupWorkflow: Check merged status and same-repository head
  BranchCleanupWorkflow->>GitHubAPI: Check open pull requests for the head branch as a base
  GitHubAPI-->>BranchCleanupWorkflow: Return open pull request data
  BranchCleanupWorkflow->>GitHubAPI: Delete the head branch if it is not protected
  GitHubAPI-->>BranchCleanupWorkflow: Return deletion result

Loading

Merge Risk: ⚪ Minimal · up to ad5ec

The workflow deletes merged same-repository head branches while keeping protected and in-use ones. No concrete defect was found. One unconfirmed concern remains: branches containing a slash might not be deleted. That would leave the branch in place and would not cause harm.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		Apprentice, the title clearly summarises the main change: deleting merged pull requests' head branches while applying an allowlist.
Description check		Apprentice, the description directly explains the workflow trigger, branch allowlist, permissions, deletion behaviour, and validation performed. The power of the Dark Side is clear.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Apprentice, the branch rules stand in place,
Merged heads pass through the workflow gate.
Protected branches remain untouched,
Other refs meet the delete request.
Missing branches earn a notice;
The Dark Side logs errors that fail.}

_{Comment @coderabbitai help to get the list of available commands.}

[rishitank]

Self-review by Claude of the final file (blob acc371c), which is byte-identical to the version proven live on rishitank/test#16. CodeRabbit approved the first version. The second adds three things, raised by CodeRabbit on sibling repos:

• it keeps a branch that is the head of another open PR;
• it deletes only if the ref still equals pull_request.head.sha;
• each permission has a comment.

Checked: no ${{ }} in run:, minimal permissions, and same-repo merged PRs only. actionlint and shellcheck are clean, and all checks are green. Nothing to fix.