[rishitank]

Why

Merged PR branches pile up. GitHub has no account-wide setting to delete them: "Automatically delete head branches" is a per-repository toggle, and it deletes every merged head branch with no exceptions. Private repositories on the Free plan can't protect branches, so that toggle could delete a long-lived branch such as develop the first time it is merged as a PR head.

This workflow does the cleanup with an explicit allowlist instead.

What changed

• New .github/workflows/branch-cleanup.yml. Self-contained, no reusable workflow (rishitank/.github main is ruleset-blocked, so a shared copy can't land yet).
  • Trigger: pull_request closed. The one job runs only when the PR was merged and its head is in this repository (never a fork's branch).
  • Keeps the head branch, with a ::notice::, when it is the default branch, or one of main, master, develop, staging, test, gh-pages, deploy-*, release/*, or when any open PR still uses it as its base.
  • Otherwise deletes it with gh api -X DELETE repos/$REPO/git/refs/heads/<ref>, the ref URL-encoded with jq @uri. "Reference does not exist" (422) or a 404 counts as success, since the branch is already gone.
  • Permissions: workflow default {}; the job gets contents: write (delete the ref) and pull-requests: read (the open-PR check). timeout-minutes: 2.
  • No ${{ }} in run:. Every event value reaches the shell through env: and is quoted.
• Checked locally: actionlint and shellcheck are clean. The script was run against a stub gh for the default branch, each allowlisted name, a branch with open child PRs, a ref containing /, a space and #, an already-deleted ref (422 and 404), and a 403, which fails the job.
• The live proof is ci: delete a PR's head branch after it merges, with an allowlist test#15: merging it should delete its own ci/branch-cleanup branch.

🤖 Generated with Claude Code

https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ffb645ba-af6b-438b-bce9-932b9cd96038

📥 Commits

Reviewing files that changed from the base of the PR and between 995cf76 and 054973d.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (11)

• GitHub Check: security / Secrets
• GitHub Check: security / Ecosystem audit
• GitHub Check: security / Vulnerable dependencies
• GitHub Check: actionlint / actionlint
• GitHub Check: Test
• GitHub Check: Lint
• GitHub Check: Type Check
• GitHub Check: CodeQL
• GitHub Check: Dependency Review
• GitHub Check: Security Audit
• GitHub Check: Enable Auto-Merge

🧰 Additional context used

🪛 zizmor (1.30.1)

.github/workflows/branch-cleanup.yml

[warning] 30-30: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)

---

[info] 25-25: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)

---

[warning] 18-20: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

🔇 Additional comments (1)

.github/workflows/branch-cleanup.yml (1)

63-64: 🎯 Functional Correctness

The broad 404 concern remains undecidable, Apprentice.

The deletion request uses the documented GitHub REST path and has Contents: write. GitHub documents 204 for successful deletion but does not define the 404 response or the exact error text for this operation. Therefore, the evidence does not establish that another 404 can occur here, or that matching only Reference does not exist is safe.

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Automatically removes merged pull request branches unless they are protected by naming rules or still serve as the base for an open pull request.

Walkthrough

Adds a workflow that runs when a pull request closes. If the pull request was merged and its head branch belongs to the current repository, the workflow preserves specified branches and deletes eligible head branches.

Changes

Merged branch cleanup

Layer / File(s)	Summary
Branch cleanup workflow .github/workflows/branch-cleanup.yml	Adds checks for merged pull requests from the current repository. The workflow preserves the default branch, specified branch names and patterns, and branches used as the base of open pull requests. It deletes other head refs, reports missing refs, and fails on other API errors.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 05497

The workflow is ready to merge after normal checks; the reported deletion concern remains unconfirmed.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: deleting a merged pull request's head branch while applying an allowlist.
Description check		The description directly explains the workflow, its safeguards, permissions, error handling, and validation. The power of the Dark Side is evident.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Apprentice, the merged branch leaves the stage,
Protected names remain beyond the blade.
Open pull request bases hold their ground,
Other head refs are cut down.
A missing ref earns only a notice,
Other errors halt the workflow’s focus.}

_{Comment @coderabbitai help to get the list of available commands.}