Add runtime API to asynchronously merge GitHub PRs

[michelemin]

This supports direct merge or merging via a merge queue.

On success, it returns the full body provided by GH, leaving it to the rule to parse it and extract what's relevant.

[Copilot]

🟡 Changes recommended

The new plaid_stl::github::merge_pr wrapper returns the entire pre-zeroed buffer instead of truncating to the byte count written, which can corrupt the returned response string.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new GitHub runtime API function to merge PRs asynchronously (direct merge or via merge queue), returning the raw GitHub response body for downstream rule parsing.

Changes:

• Exposes github_merge_pr via the Plaid runtime function registry and implements the GitHub merge-async call.
• Adds MergePrRequest (plus merge method/action enums) and a new plaid_stl::github::merge_pr wrapper.
• Fixes a GitHub REST status-code check (expects 201 for comment creation) and bumps crate versions to 47.1.0.

File summaries

File	Description
runtime/plaid/src/functions/api.rs	Registers the new github_merge_pr runtime function.
runtime/plaid/src/apis/github/repos.rs	Corrects expected success status code for comment creation to 201.
runtime/plaid/src/apis/github/pull_requests.rs	Implements the runtime GitHub merge-async PR merge API call.
runtime/plaid/Cargo.toml	Bumps plaid version to 47.1.0.
runtime/plaid-stl/src/github/pull_request.rs	Adds merge request types and the STL wrapper for merge_pr.
runtime/plaid-stl/Cargo.toml	Bumps plaid_stl version to 47.1.0.
runtime/Cargo.lock	Updates lockfile for version bumps.
modules/Cargo.lock	Updates lockfile for plaid_stl version bump.

Review details

• Files reviewed: 6/8 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

The new STL merge_pr wrapper returns the entire fixed-size buffer without truncating to the actual byte length, which can corrupt the returned response payload.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

runtime/plaid/src/apis/github/pull_requests.rs:266

• This comment overstates the validation performed by deserializing to u32: 0 is still possible, and other semantic invalid values will only be rejected by GitHub. Consider rewording to avoid implying the input is fully validated here.

        // We do not validate the PR number because we are deserializing to a u32, which is all the validation we need.

runtime/plaid-stl/src/github/pull_request.rs:756

• return_buffer is not truncated to the number of bytes written (res) before converting to String, so the returned value will include trailing NULs and can break JSON parsing of the GitHub response.

    // This should be safe because unless the Plaid runtime is expressly trying
    // to mess with us, this came from a String in the API module.
    Ok(String::from_utf8(return_buffer).unwrap())
}

• Files reviewed: 6/8 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The new merge_pr implementation includes a misleading comment about PR-number validation and currently permits number = 0, which should be rejected explicitly.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

runtime/plaid/src/apis/github/pull_requests.rs:268

• u32 deserialization only guarantees the PR number is non-negative; it still allows 0, which is not a valid PR number. As written, number = 0 will generate a request to /pulls/0/... and the inline comment is misleading—either validate >= 1 or adjust the comment accordingly.

        let owner = self.validate_org(&request.params.owner)?;
        let repo = self.validate_repository_name(&request.params.repo)?;
        // We do not validate the PR number because we are deserializing to a u32, which is all the validation we need.
        let pull_number = request.params.number;

• Files reviewed: 6/8 changed files
• Comments generated: 0 new
• Review effort level: Lite