[rishitank]

Why

Merged PR branches pile up. GitHub has no account-wide setting to delete them: "Automatically delete head branches" is a per-repository toggle, and it deletes every merged head branch with no exceptions. Private repositories on the Free plan can't protect branches, so that toggle could delete a long-lived branch such as develop the first time it is merged as a PR head.

This workflow does the cleanup with an explicit allowlist instead.

What changed

• New .github/workflows/branch-cleanup.yml. Self-contained, no reusable workflow (rishitank/.github main is ruleset-blocked, so a shared copy can't land yet).
  • Trigger: pull_request closed. The one job runs only when the PR was merged and its head is in this repository (never a fork's branch).
  • Keeps the head branch, with a ::notice::, when it is the default branch, or one of main, master, develop, staging, test, gh-pages, deploy-*, release/*, or when any open PR still uses it as its base.
  • Otherwise deletes it with gh api -X DELETE repos/$REPO/git/refs/heads/<ref>, the ref URL-encoded with jq @uri. "Reference does not exist" (422) or a 404 counts as success, since the branch is already gone.
  • Permissions: workflow default {}; the job gets contents: write (delete the ref) and pull-requests: read (the open-PR check). timeout-minutes: 2.
  • No ${{ }} in run:. Every event value reaches the shell through env: and is quoted.
• Checked locally: actionlint and shellcheck are clean. The script was run against a stub gh for the default branch, each allowlisted name, a branch with open child PRs, a ref containing /, a space and #, an already-deleted ref (422 and 404), and a 403, which fails the job.
• The same file was proven live on ci: delete a PR's head branch after it merges, with an allowlist test#15.

🤖 Generated with Claude Code

https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1dc17963-fbe3-4b0c-9f57-49a5ae14c846

📥 Commits

Reviewing files that changed from the base of the PR and between b85168f and 3fd091b.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

📝 Summary

Summary by CodeRabbit

• Chores
  • Merged pull requests now trigger automatic cleanup of their source branches when those branches are not protected or used by an open pull request. Protected branches and branches needed by open pull requests are retained.

Walkthrough

Adds a GitHub Actions workflow that runs when a pull request closes. For merged pull requests from the same repository, it preserves specified branches and branches used as the base of open pull requests. It deletes other branch refs and handles missing refs separately from other API errors.

Changes

Branch cleanup workflow

Layer / File(s)	Summary
Workflow eligibility and branch preservation .github/workflows/branch-cleanup.yml	Adds merged and same-repository conditions, protected branch checks, and a check for open pull request base branches. Comments describe the workflow scope and stated rationale for its allowlist.
Branch ref deletion and error handling .github/workflows/branch-cleanup.yml	Deletes the encoded branch ref. A missing ref produces a notice; other API errors cause the step to fail.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to b8516

The branch-cleanup workflow is mergeable after normal checks; no concrete merge-blocking defect remains established.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: deleting a merged PR head branch while applying an allowlist.
Description check		The description directly explains the workflow, its safeguards, permissions, deletion behaviour, and validation. The power of the Dark Side is evident, Apprentice.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Apprentice, the closed branch meets its test,
Protected names remain at rest.
Open requests hold their base in place,
The encoded ref is then erased.
The Dark Side marks each outcome clear.}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🔇 Additional comments (2)

.github/workflows/branch-cleanup.yml-29-31 (1)

29-31: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Apprentice, document your permissions. Zizmor reports them as undocumented.

Add short comments that explain why each permission is needed. contents: write is needed to delete the ref. pull-requests: read is needed for gh pr list. This shows the power of the Dark Side.

Proposed change

     permissions:
-      contents: write
-      pull-requests: read
+      contents: write # Delete the merged head branch ref.
+      pull-requests: read # List open PRs that use the branch as their base.

Source: Linters/SAST tools

.github/workflows/branch-cleanup.yml-26-26 (1)

26-26: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Apprentice, the rebel scum hides in a race: a failed lookup of open PRs is not the only risk, the merged gate is also too loose.

The if condition passes for every merged PR from the same repository. The workflow deletes the head branch of any merged PR that is not on the allowlist. Allowlist patterns do not cover long-lived branches such as next, dev, production or hotfix/*. Merging one of these branches as a PR head deletes it. Extend the allowlist to match your real long-lived branches.

The gh pr list --repo "$REPO" --base "$HEAD_REF" --state open check has one more gap. It returns a count only. It does not distinguish PRs with a base in the same repository from those in other contexts. This is acceptable, but document the assumption.

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 64793a01-e836-46e8-93c5-f0886f1cc7b4

📥 Commits

Reviewing files that changed from the base of the PR and between 89d1e15 and b85168f.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Review details

🧰 Additional context used

🪛 zizmor (1.30.1)

.github/workflows/branch-cleanup.yml

[warning] 30-30: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

---

[info] 25-25: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

---

[warning] 18-20: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

[rishitank]

Self-review by Claude of the final file (blob acc371c), which is byte-identical to the version proven live on rishitank/test#16. Checked:

• no ${{ }} in run:;
• workflow permissions {}, and the job gets only contents: write and pull-requests: read, each commented;
• merged same-repo PRs only, plus the allowlist;
• keeps branches that are the base or head of open PRs;
• deletes only if the ref still equals pull_request.head.sha;
• 422/404 count as success, and other errors fail red.

actionlint and shellcheck are clean. CodeRabbit's review-body suggestions are handled as follows. The permission comments were added. The allowlist stays as specified (main, master, develop, staging, test, gh-pages, deploy-, release/); next, dev, production and hotfix/* aren't used in this estate. Nothing else to fix.