Goal

Replace per-repo Mergify configuration duplication with a centralized org-wide config in both .github repos, using Mergify's extends keyword. Each consumer repo's .github/mergify.yml becomes a single extends: .github line.

Why

After T8531 lands, 32 repos will carry byte-identical Mergify configs (conflict-label rule + commands_restrictions). Any future policy change requires 30+ PRs. Centralizing to the .github repos means future changes are 2 PRs (one per org) with instant propagation.

Current state (post-T8531)

All repos have:

yaml
pull_request_rules:
  - name: Label conflicting pull requests
    conditions: [conflict, '-closed']
    actions:
      label:
        toggle: [conflicts]

commands_restrictions:
  backport: &allowed
    conditions:
      - or:
        - sender=@<org>/maintainers
        - sender=vyosbot
  copy: *allowed
  dequeue: *allowed
  queue: *allowed
  rebase: *allowed
  refresh: *allowed
  requeue: *allowed
  squash: *allowed
  unqueue: *allowed
  update: *allowed

Target state

vyos/.github/.github/mergify.yml — full config (conflict-label + commands_restrictions with @vyos/maintainers)

VyOS-Networks/.github/.github/mergify.yml — same with @VyOS-Networks/maintainers

Each consumer repo: extends: .github

Mergify extends merge behavior

• pull_request_rules: merged (appended). Same-name rule → local wins.
• commands_restrictions: merged. Same-key command → local wins.
• defaults: merged. Local takes precedence.
• shared: NOT merged across repos (local-only, irrelevant here).

Source repo must have Mergify installed. Reads from the default branch (= current for both .github repos).

Prerequisites

1. Mergify app must be installed on vyos/.github and VyOS-Networks/.github
2. T8531 must be fully merged first (establishes per-repo baseline)
3. Confirm Mergify reads from current branch on .github repos

Implementation plan

1. Install Mergify on both .github repos (org admin)
2. Add .github/mergify.yml to both .github repos with the full org-wide config
3. Replace each consumer repo's mergify.yml with extends: .github (batch PRs)
4. Repos needing local overrides keep their rules alongside extends:
5. Verify conflict labelling and commands_restrictions still work post-migration

Risks

• Invisible dependency: repo behavior controlled from .github — debugging requires checking both configs
• If Mergify app is removed from .github repos, all consumer repos lose inherited config silently
• Team slug difference between orgs prevents a single shared source (requires one config per org)

References

• Parent task: T8531 (restricts Mergify commands to maintainers)
• Mergify sharing docs: https://docs.mergify.com/configuration/sharing/
• Architecture page: https://vyos.atlassian.net/wiki/spaces/VYOS/pages/792723546
• Jira change request: IS-404