docs(rulesets): note last-push approval needs a non-zero approval count

[sileht]

Mergify injects the last-push-approval condition only when the same rule also
requires at least one approving review. With the required approval count at 0,
the condition is not injected.

The page promised the injection unconditionally, which is wrong wherever
Mergify is allowed to bypass the rule: there the pull request merges with an
unapproved latest push. Qualify the section and the pull_request row of the
compatibility table.

Also corrected in the same section

• "approved by someone other than the author" was wrong. GitHub's rule and
  Mergify's implementation both key on whoever pushed the most recent commit,
  which is also what the config schema says.
• The GitHub option label is "most recent reviewable push".
• Widened to "branch protection or ruleset": both paths gate injection
  identically.
• "injects a matching condition into your Merge Protections" pointed at the
  wrong product. Injection produces merge conditions, as this page's own
  introduction says.

Framing

This states the limitation and what makes the condition get injected. It
deliberately does not promise that raising the approval count closes the hole,
because injection has other gates this page does not cover. Two alternatives
were considered and dropped:

• Telling users to author the condition in .mergify.yml. It does evaluate
  correctly at count 0, but it is not an attribute users are meant to author.
• Telling users to drop Mergify from the bypass list. This page recommends the
  opposite everywhere, so that is folded into the caveat as the reason the gap
  is reachable, rather than presented as a fix.

Fixes MRGFY-8699

[mergify]

Merge Protections

🔴 2 of 6 protections blocking · waiting on 👀 reviews

	Protection	Waiting on
🔴	👀 Review Requirements	👀 reviews
🔴	🔎 Reviews	👀 reviews
🟢	🤖 Continuous Integration	—
🟢	Enforce conventional commit	—
🟢	📕 PR description	—
🟢	🚦 Auto-queue	—

🔴 👀 Review Requirements

Waiting for

• #approved-reviews-by >= 2

This rule is failing.

• any of:
  • #approved-reviews-by >= 2
  • author = dependabot[bot]
  • all of:
    • author = mergify-ci-bot
    • -head ~= ^docs-agent/

🔴 🔎 Reviews

Waiting for

• #review-requested = 0

This rule is failing.

• #review-requested = 0
• #changes-requested-reviews-by = 0
• #review-threads-unresolved = 0

---

Show 4 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success = build
  • check-success = lint
  • check-success = test
  • any of:
    • check-success = test-broken-links
    • label = ignore-broken-links
  • any of:
    • check-success=Cloudflare Pages
    • -head-repo-full-name~=^Mergifyio/

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[Copilot]

Pull request overview

Updates the GitHub rulesets documentation to accurately describe when Mergify injects the require_last_push_approval-equivalent merge condition, clarifying that it only happens when the rule also requires at least one approving review, and documenting the practical workaround.

Changes:

• Qualifies the “Require Approval of the Most Recent Push” section to require a non-zero required approval count.
• Adds a caution callout explaining the required_approving_review_count: 0 limitation and the bypass-actor scenario impact.
• Updates the ruleset compatibility table to note the injection condition for require_last_push_approval.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sileht]

Revision history

#	Type	Changes	Reason	Date
1	initial	d660756		2026-08-15 16:09 UTC
2	content	d660756 → 494859c		2026-08-15 16:09 UTC