Bypass actor on ruleset is ignored when PR needs to enter the merge queue

[dge808]

🏷️ Discussion Type

Bug

Body

We have a GitHub App that creates PRs, and we want this app to automerge its own PRs without needing a human review. I added the app as a bypass actor to the ruleset that enforces a review, and this works just fine until merge-queue is enabled.
When the merge queue is enabled, PRs created by the app are stuck in the "Awaiting approval" state. Is it expected that bypass actors are just never honoured for merge queue entry?

There is a similar report here, but unfortunately it is not answered: https://github.com/orgs/community/discussions/110908#discussioncomment-9688029
And here is another one:
https://github.com/orgs/community/discussions/45208

Setup
We have these rulesets on the default branch:

• require-pr: needs 1 approving review. GitHub App is added to the bypass list of this ruleset.
• status-checks: required status checks need to pass before PR can be merged (not bypassable)
• merge-queue (the App is not in the bypass list for this one, because if it is merged directly it will skip merge queue benefits)

The app itself enables automerge on its PRs.

Expected behavior
Since the app can bypass the review ruleset, we expected GitHub to add the PR to the merge queue as soon as checks are green, without waiting for an approval.

Actual behaviour
The PR just sits there with auto-merge enabled but never gets added to the queue:

 reviewDecision: REVIEW_REQUIRED
mergeQueueEntry: null
mergeStateStatus: BLOCKED

Checks are green, automerge is enabled.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams.
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight.
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[Nitinmall-1390]

Here is a direct response addressing the technical behavior of ruleset bypasses with merge queues:

---

This behavior occurs due to how Auto-merge interacts with Rulesets when Merge Queue is enabled:

Why This Happens

• Auto-Merge Pre-Validation: Before auto-merge attempts to put a PR into the merge queue, GitHub's branch protection engine evaluates whether the PR currently meets all requirements for entry.
• Bypass Actors vs. Branch Entry: The "Bypass List" in rulesets grants permission to bypass rules at the moment of merging or pushing, but auto-merge requires branch protection requirements (like required reviews or Codeowners) to be explicitly satisfied or bypassed via the merge action itself. Because the app has not yet actively bypassed the rule (it is waiting in an auto-merge state), reviewDecision stays as REVIEW_REQUIRED, blocking entry into the queue.

Workarounds

1. Direct Queue Enqueue via API/CLI (Recommended): Instead of enabling auto-merge on the PR, have the GitHub App directly add the PR to the merge queue using GraphQL (enqueuePullRequest) or GitHub CLI (gh pr merge --auto). Because the app initiates the action, its bypass privileges apply immediately.
2. Dedicated Automated Branch/Ruleset: Exclude PRs originating from your GitHub App (or target branches reserved for automation) from the review ruleset entirely, rather than using a bypass list actor.
3. App-Approved Self-Reviews: If allowed in your organization policies, configure the GitHub App to submit an explicit approval review (APPROVE) on its own PR upon creation.