feat(merge): add --all flag for scanning open PRs with safety guardrails

packages/merge/src/__tests__/fixtures/github-git-blob.ts

@@ -0,0 +1,31 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock Git blob operations.
+ */
+
+import crypto from 'crypto';
+
+export async function createBlob(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  content: string,
+  _encoding: 'utf-8' | 'base64' = 'utf-8',
+) {
+  return {
+    sha: crypto.createHash('sha1').update(content).digest('hex'),
+  };
+}

packages/merge/src/__tests__/fixtures/github-git-commit.ts

@@ -0,0 +1,33 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock Git commit operations.
+ */
+
+let commitCounter = 0;
+export function resetCommitCounter() {
+  commitCounter = 0;
+}
+export async function createCommit(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  _message: string,
+  _tree: string,
+  parents: string[],
+) {
+  commitCounter++;
+  return { sha: `new-commit-sha-${commitCounter}`, parents };
+}

packages/merge/src/__tests__/fixtures/github-git-ref.ts

@@ -0,0 +1,52 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock Git ref operations.
+ */
+
+import { state } from './github-state.js';
+
+export async function createRef(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  ref: string,
+  sha: string,
+) {
+  state.refs[ref] = sha;
+  return { ref, sha };
+}
+
+export async function updateRef(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  ref: string,
+  sha: string,
+  _force: boolean = false,
+) {
+  if (!state.refs[ref]) throw new Error('Not found');
+  state.refs[ref] = sha;
+  return { ref, sha };
+}
+
+export async function deleteBranch(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  _branch: string,
+) {
+  // no-op in tests
+}

packages/merge/src/__tests__/fixtures/github-git-tree.ts

@@ -0,0 +1,36 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock Git tree operations.
+ */
+
+export async function getTree(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  _tree_sha: string,
+) {
+  return {};
+}
+
+export async function createTree(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  _base_tree: string,
+  _tree: any[],
+) {
+  return { sha: 'new-tree-sha' };
+}

packages/merge/src/__tests__/fixtures/github-git.ts

@@ -0,0 +1,25 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock low-level Git object operations.
+ */
+
+export { getTree, createTree } from './github-git-tree.js';
+export { createBlob } from './github-git-blob.js';
+export {
+  createCommit,
+  resetCommitCounter,
+} from './github-git-commit.js';
+export { createRef, updateRef, deleteBranch } from './github-git-ref.js';

packages/merge/src/__tests__/fixtures/github-pulls-create.ts

@@ -0,0 +1,38 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock pull request create operation.
+ */
+
+import { state } from './github-state.js';
+
+export async function createPullRequest(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  title: string,
+  head: string,
+  _base: string,
+  _body?: string,
+) {
+  const pr = {
+    number: 999,
+    html_url: 'https://github.com/owner/repo/pull/999',
+    title,
+  };
+  state.pullRequests = state.pullRequests ?? {};
+  state.pullRequests[head] = pr;
+  return pr;
+}

packages/merge/src/__tests__/fixtures/github-pulls-get.ts

@@ -0,0 +1,28 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock pull request get operation.
+ */
+
+import { state } from './github-state.js';
+
+export async function getPullRequest(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  pull_number: number,
+) {
+  return state.prs[pull_number];
+}

packages/merge/src/__tests__/fixtures/github-pulls-list.ts

@@ -0,0 +1,47 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock pull request list operations.
+ */
+
+import { state } from './github-state.js';
+
+export async function listPullRequests(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  head: string,
+  _base: string,
+  _state: string = 'open',
+) {
+  const stored = state.pullRequests?.[head];
+  return stored ? [stored] : [];
+}
+
+export async function listOpenPullRequests(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  base: string,
+  options?: { labels?: string[] },
+) {
+  let prs = state.openPrs?.[base] ?? [];
+  if (options?.labels && options.labels.length > 0) {
+    prs = prs.filter((pr: any) =>
+      pr.labels?.some((l: string) => options.labels!.includes(l)),
+    );
+  }
+  return prs;
+}

packages/merge/src/__tests__/fixtures/github-pulls-merge.ts

@@ -0,0 +1,27 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock pull request merge operation.
+ */
+
+export async function mergePullRequest(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  _pull_number: number,
+  _merge_method: string = 'merge',
+) {
+  return { sha: 'merge-sha' };
+}

packages/merge/src/__tests__/fixtures/github-pulls.ts

@@ -0,0 +1,25 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock pull request operations.
+ */
+
+export { getPullRequest } from './github-pulls-get.js';
+export { createPullRequest } from './github-pulls-create.js';
+export {
+  listPullRequests,
+  listOpenPullRequests,
+} from './github-pulls-list.js';
+export { mergePullRequest } from './github-pulls-merge.js';

packages/merge/src/__tests__/fixtures/github-repos-branch.ts

@@ -0,0 +1,28 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * Mock repository branch operations.
+ */
+
+import { state } from './github-state.js';
+
+export async function getBranch(
+  _octokit: any,
+  _owner: string,
+  _repo: string,
+  branch: string,
+) {
+  return state.branches[branch] || state.branches.main;
+}