[rishitank]

Why

Merged PR branches pile up. GitHub has no account-wide setting to delete them: "Automatically delete head branches" is a per-repository toggle, and it deletes every merged head branch with no exceptions. Private repositories on the Free plan can't protect branches, so that toggle could delete a long-lived branch such as develop the first time it is merged as a PR head.

This workflow does the cleanup with an explicit allowlist instead.

What changed

• New .github/workflows/branch-cleanup.yml. Self-contained, no reusable workflow (rishitank/.github main is ruleset-blocked, so a shared copy can't land yet).
  • Trigger: pull_request closed. The one job runs only when the PR was merged and its head is in this repository (never a fork's branch).
  • Keeps the head branch, with a ::notice::, when it is the default branch, or one of main, master, develop, staging, test, gh-pages, deploy-*, release/*, or when any open PR still uses it as its base.
  • Otherwise deletes it with gh api -X DELETE repos/$REPO/git/refs/heads/<ref>, the ref URL-encoded with jq @uri. "Reference does not exist" (422) or a 404 counts as success, since the branch is already gone.
  • Permissions: workflow default {}; the job gets contents: write (delete the ref) and pull-requests: read (the open-PR check). timeout-minutes: 2.
  • No ${{ }} in run:. Every event value reaches the shell through env: and is quoted.
• Checked locally: actionlint and shellcheck are clean. The script was run against a stub gh for the default branch, each allowlisted name, a branch with open child PRs, a ref containing /, a space and #, an already-deleted ref (422 and 404), and a 403, which fails the job.
• The live proof is ci: delete a PR's head branch after it merges, with an allowlist test#15: merging it should delete its own ci/branch-cleanup branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 52 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: aafdb117-ff88-47b1-9586-b39d2cac0eb9

📥 Commits

Reviewing files that changed from the base of the PR and between 765a4d8 and 41dd53e.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6aaf2ca1-2ea7-4728-872b-307b0a23e67e

📥 Commits

Reviewing files that changed from the base of the PR and between b104fe0 and 765a4d8.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🪛 zizmor (1.30.1)

.github/workflows/branch-cleanup.yml

[warning] 30-30: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

---

[info] 25-25: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

---

[warning] 18-20: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

🔇 Additional comments (2)

.github/workflows/branch-cleanup.yml (2)

1-59: LGTM!

Also applies to: 65-68

---

60-64: 🎯 Functional Correctness

Keep the encoded branch reference.

The proposed change is not required. GitHub handles slashes in branch names for this API path, so encoding ci/branch-cleanup as ci%2Fbranch-cleanup does not establish a failed deletion. The workflow can keep the current jq '@uri' conversion.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • After a pull request is merged, its source branch is automatically deleted unless it is a protected branch or is needed as the base of another open pull request. The default branch and designated long-lived branches are preserved. If the source branch has already been removed, cleanup continues without treating it as an error. Other deletion errors are reported.

Walkthrough

A new workflow runs when a pull request closes. After a merge, it preserves protected branches and branches used by open pull requests. It deletes other eligible head branches and handles missing branches without failing.

Changes

Merged Branch Cleanup

Layer / File(s)	Summary
Branch eligibility and deletion .github/workflows/branch-cleanup.yml	The workflow runs for merged pull requests from the current repository. It keeps the default and listed branches, plus branches used as the base of open pull requests. It deletes other head branches. A missing branch produces a notice; other deletion errors fail the step.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 765a4

The workflow’s encoded branch reference follows GitHub’s documented deletion format. No actionable merge-blocking risk remains after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly summarises the main change: an allowlisted CI workflow deletes a pull request head branch after merge.
Description check		The description is directly related to the changeset and explains the workflow trigger, branch allowlist, deletion behaviour, permissions, and validation performed.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Apprentice, the merged branch awaits its fate
Protected names remain beyond the gate
Open pull requests keep their bases safe
Others leave the branch list without a trace
The Dark Side cleans, with errors kept in sight}

_{Comment @coderabbitai help to get the list of available commands.}

[rishitank]

Self-review by Claude of the final file (blob acc371c), which is byte-identical to the version proven live on rishitank/test#16. CodeRabbit approved the first version. The second adds three things, raised by CodeRabbit on sibling repos:

• it keeps a branch that is the head of another open PR;
• it deletes only if the ref still equals pull_request.head.sha;
• each permission has a comment.

Checked: no ${{ }} in run:, minimal permissions, and same-repo merged PRs only. actionlint and shellcheck are clean, and all checks are green. Nothing to fix.