From bbcd91e53635aae8937e0883403eca84dd4184b8 Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 14:58:06 -0400 Subject: [PATCH 1/9] Use GitHub app --- .github/workflows/dependabot-automerge.md | 6 ++++++ .github/workflows/dependabot-automerge.yaml | 21 +++++++++++++++++++-- 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-automerge.md b/.github/workflows/dependabot-automerge.md index af3f1ac..928d71e 100644 --- a/.github/workflows/dependabot-automerge.md +++ b/.github/workflows/dependabot-automerge.md @@ -18,6 +18,7 @@ permissions: jobs: automerge: uses: bufbuild/base-workflows/.github/workflows/dependabot-automerge.yaml@main + secrets: inherit with: github-auto-merge: true ``` @@ -42,6 +43,7 @@ permissions: jobs: automerge: uses: bufbuild/base-workflows/.github/workflows/dependabot-automerge.yaml@main + secrets: inherit with: github-auto-merge: false ``` @@ -123,3 +125,7 @@ workflow's approval, that's why. > merges eligible PRs immediately, without waiting for any checks. Only > set it to `true` once the branch-protection setup ("required status > checks" + "Allow auto-merge") is done. + +## Secrets + +`secrets: inherit` is required because approvals and merges are performed with a GitHub App token minted from the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_KEY` org secrets rather than `GITHUB_TOKEN`. This is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. If the token minting step fails with missing credentials, the caller is missing `secrets: inherit`. diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index 7dd2537..3414589 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -57,10 +57,19 @@ jobs: run: | gh pr edit "${PR_URL}" --remove-label "automerge: eligible" || true gh pr merge --disable-auto "${PR_URL}" || true + # Enabling auto-merge must use an app token, not GITHUB_TOKEN, + # so that CI runs post-merge. + - name: Create App Token + id: app-token + if: inputs.github-auto-merge && steps.label.outcome == 'success' + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + with: + app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} + private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_KEY }} - name: Enable Auto-Merge if: inputs.github-auto-merge && steps.label.outcome == 'success' env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_URL: ${{ github.event.pull_request.html_url }} run: | gh pr review --approve "${PR_URL}" @@ -80,9 +89,17 @@ jobs: group: dependabot-automerge-sweep cancel-in-progress: false steps: + # Merging must use an app token, not GITHUB_TOKEN, + # so that CI runs post-merge. + - name: Create App Token + id: app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + with: + app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} + private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_KEY }} - name: Merge Labeled Dependabot PRs env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} REPO: ${{ github.repository }} run: | gh pr list --repo "${REPO}" --author 'app/dependabot' \ From 976eda03e95e9fb38e23c54500a942a4fd6845ac Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 15:12:51 -0400 Subject: [PATCH 2/9] DEPENDENCY_AUTOMERGE_APP_KEY -> DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY --- .github/workflows/dependabot-automerge.md | 2 +- .github/workflows/dependabot-automerge.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependabot-automerge.md b/.github/workflows/dependabot-automerge.md index 928d71e..e04f18c 100644 --- a/.github/workflows/dependabot-automerge.md +++ b/.github/workflows/dependabot-automerge.md @@ -128,4 +128,4 @@ workflow's approval, that's why. ## Secrets -`secrets: inherit` is required because approvals and merges are performed with a GitHub App token minted from the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_KEY` org secrets rather than `GITHUB_TOKEN`. This is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. If the token minting step fails with missing credentials, the caller is missing `secrets: inherit`. +`secrets: inherit` is required because approvals and merges are performed with a GitHub App token minted from the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY` org secrets rather than `GITHUB_TOKEN`. This is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. If the token minting step fails with missing credentials, the caller is missing `secrets: inherit`. diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index 3414589..9c4dca6 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -65,7 +65,7 @@ jobs: uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} - private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_KEY }} + private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} - name: Enable Auto-Merge if: inputs.github-auto-merge && steps.label.outcome == 'success' env: @@ -96,7 +96,7 @@ jobs: uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 with: app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} - private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_KEY }} + private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} - name: Merge Labeled Dependabot PRs env: GH_TOKEN: ${{ steps.app-token.outputs.token }} From bcddcb46e42a2e2e3d23fd04368acb6486ef8b0a Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 15:17:02 -0400 Subject: [PATCH 3/9] update secret docs --- .github/workflows/dependabot-automerge.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/dependabot-automerge.md b/.github/workflows/dependabot-automerge.md index e04f18c..92b2b02 100644 --- a/.github/workflows/dependabot-automerge.md +++ b/.github/workflows/dependabot-automerge.md @@ -129,3 +129,5 @@ workflow's approval, that's why. ## Secrets `secrets: inherit` is required because approvals and merges are performed with a GitHub App token minted from the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY` org secrets rather than `GITHUB_TOKEN`. This is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. If the token minting step fails with missing credentials, the caller is missing `secrets: inherit`. + +The two jobs resolve secrets from different stores, so the app ID and key must be registered as both org **Actions secrets** and org **Dependabot secrets**, under the same names. The mark job runs on Dependabot-triggered `pull_request` events, which only see Dependabot secrets ([GitHub Actions secrets are not available](https://docs.github.com/en/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions) in those runs). The sweep job runs on `workflow_run`, `schedule`, and `workflow_dispatch` events, which see regular Actions secrets. Missing either store breaks one of the two merge paths. From 5110d886dfb4afb72c618a9e9bbb7a01d5256598 Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 15:37:50 -0400 Subject: [PATCH 4/9] pass via arg --- .github/workflows/dependabot-automerge.md | 10 +++++++--- .github/workflows/dependabot-automerge.yaml | 5 +++++ 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependabot-automerge.md b/.github/workflows/dependabot-automerge.md index 92b2b02..2df24c3 100644 --- a/.github/workflows/dependabot-automerge.md +++ b/.github/workflows/dependabot-automerge.md @@ -18,7 +18,9 @@ permissions: jobs: automerge: uses: bufbuild/base-workflows/.github/workflows/dependabot-automerge.yaml@main - secrets: inherit + secrets: + DEPENDENCY_AUTOMERGE_APP_ID: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} + DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} with: github-auto-merge: true ``` @@ -43,7 +45,9 @@ permissions: jobs: automerge: uses: bufbuild/base-workflows/.github/workflows/dependabot-automerge.yaml@main - secrets: inherit + secrets: + DEPENDENCY_AUTOMERGE_APP_ID: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} + DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} with: github-auto-merge: false ``` @@ -128,6 +132,6 @@ workflow's approval, that's why. ## Secrets -`secrets: inherit` is required because approvals and merges are performed with a GitHub App token minted from the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY` org secrets rather than `GITHUB_TOKEN`. This is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. If the token minting step fails with missing credentials, the caller is missing `secrets: inherit`. +The caller must pass the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY` org secrets through explicitly, as in the examples above. Approvals and merges are performed with a GitHub App token minted from them rather than `GITHUB_TOKEN`. This is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. Both secrets are declared `required`, so a caller that omits them fails immediately at workflow validation rather than at the token minting step. The two jobs resolve secrets from different stores, so the app ID and key must be registered as both org **Actions secrets** and org **Dependabot secrets**, under the same names. The mark job runs on Dependabot-triggered `pull_request` events, which only see Dependabot secrets ([GitHub Actions secrets are not available](https://docs.github.com/en/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions) in those runs). The sweep job runs on `workflow_run`, `schedule`, and `workflow_dispatch` events, which see regular Actions secrets. Missing either store breaks one of the two merge paths. diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index 9c4dca6..bff4fa5 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -16,6 +16,11 @@ on: github-auto-merge: type: boolean required: true + secrets: + DEPENDENCY_AUTOMERGE_APP_ID: + required: true + DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY: + required: true permissions: contents: write pull-requests: write From 032446758014677657de4c0f3ce5e3849adc70ec Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 15:38:13 -0400 Subject: [PATCH 5/9] explicitly state permissions required --- .github/workflows/dependabot-automerge.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index bff4fa5..f9712b0 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -71,6 +71,8 @@ jobs: with: app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - name: Enable Auto-Merge if: inputs.github-auto-merge && steps.label.outcome == 'success' env: @@ -102,6 +104,8 @@ jobs: with: app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write - name: Merge Labeled Dependabot PRs env: GH_TOKEN: ${{ steps.app-token.outputs.token }} From bfe8468c88e82c2c552a45a756a2d2d8b4932e0f Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 15:45:48 -0400 Subject: [PATCH 6/9] explicit perms --- .github/workflows/dependabot-automerge.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index f9712b0..ce1d500 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -106,6 +106,8 @@ jobs: private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} permission-contents: write permission-pull-requests: write + permission-checks: read + permission-statuses: read - name: Merge Labeled Dependabot PRs env: GH_TOKEN: ${{ steps.app-token.outputs.token }} From 03532af675e37653d917ad3614000f163f6525a8 Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 17:20:58 -0400 Subject: [PATCH 7/9] minimize token scopes --- .github/workflows/dependabot-automerge.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index ce1d500..612b128 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -21,10 +21,6 @@ on: required: true DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY: required: true -permissions: - contents: write - pull-requests: write - issues: write jobs: # Classifies each Dependabot PR with fetch-metadata and records the # verdict as the label. Re-runs on every Dependabot push, so a PR that From 56c7d329282c76e6144ca925713622b3246f9be4 Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 17:22:45 -0400 Subject: [PATCH 8/9] comments --- .github/workflows/dependabot-automerge.yaml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index 612b128..fc7d809 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -28,6 +28,10 @@ jobs: # its label and any previously armed auto-merge. mark: runs-on: ubuntu-latest + permissions: + contents: write # required to toggle auto-merge + pull-requests: write # required to add/remove PR labels + issues: write # required to create repo label if: >- github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' && @@ -67,8 +71,8 @@ jobs: with: app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} - permission-contents: write - permission-pull-requests: write + permission-contents: write # required to arm auto-merge + permission-pull-requests: write # required to approve PRs - name: Enable Auto-Merge if: inputs.github-auto-merge && steps.label.outcome == 'success' env: @@ -82,6 +86,7 @@ jobs: # workflow_dispatch) live in the caller stub. sweep: runs-on: ubuntu-latest + permissions: {} # GITHUB_TOKEN is unused; everything runs on the app token. if: >- github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || @@ -100,10 +105,10 @@ jobs: with: app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} - permission-contents: write - permission-pull-requests: write - permission-checks: read - permission-statuses: read + permission-contents: write # required to merge PRs + permission-pull-requests: write # required to approve PRs + permission-checks: read # required to read check results + permission-statuses: read # required to read commit statuses - name: Merge Labeled Dependabot PRs env: GH_TOKEN: ${{ steps.app-token.outputs.token }} From c33afe3c424da14ede6b02f3729b7fc5c498431e Mon Sep 17 00:00:00 2001 From: Nick Snyder Date: Wed, 22 Jul 2026 17:43:00 -0400 Subject: [PATCH 9/9] simplify to one token --- .github/workflows/dependabot-automerge.md | 12 ++----- .github/workflows/dependabot-automerge.yaml | 36 ++++++++++----------- 2 files changed, 21 insertions(+), 27 deletions(-) diff --git a/.github/workflows/dependabot-automerge.md b/.github/workflows/dependabot-automerge.md index 2df24c3..dad65cf 100644 --- a/.github/workflows/dependabot-automerge.md +++ b/.github/workflows/dependabot-automerge.md @@ -11,10 +11,7 @@ For repositories **with** required status checks: ```yaml name: dependabot-automerge on: pull_request -permissions: - contents: write - pull-requests: write - issues: write +permissions: {} jobs: automerge: uses: bufbuild/base-workflows/.github/workflows/dependabot-automerge.yaml@main @@ -38,10 +35,7 @@ on: schedule: - cron: "0 13 * * *" # 13:00 UTC (8am EST / 9am EDT) workflow_dispatch: -permissions: - contents: write - pull-requests: write - issues: write +permissions: {} jobs: automerge: uses: bufbuild/base-workflows/.github/workflows/dependabot-automerge.yaml@main @@ -132,6 +126,6 @@ workflow's approval, that's why. ## Secrets -The caller must pass the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY` org secrets through explicitly, as in the examples above. Approvals and merges are performed with a GitHub App token minted from them rather than `GITHUB_TOKEN`. This is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. Both secrets are declared `required`, so a caller that omits them fails immediately at workflow validation rather than at the token minting step. +The caller must pass the `DEPENDENCY_AUTOMERGE_APP_ID` and `DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY` org secrets through explicitly, as in the examples above. Every GitHub API operation (metadata lookup, labeling, approvals, merges) is performed with a GitHub App token minted from them; `GITHUB_TOKEN` is never used, so callers need no `permissions` grants. The app token is necessary because events created with the default `GITHUB_TOKEN` never trigger other workflows, so merging with it would silently skip CI on the default branch after the merge. Reusable workflows don't see org secrets unless the caller passes them through. Both secrets are declared `required`, so a caller that omits them fails immediately at workflow validation rather than at the token minting step. The two jobs resolve secrets from different stores, so the app ID and key must be registered as both org **Actions secrets** and org **Dependabot secrets**, under the same names. The mark job runs on Dependabot-triggered `pull_request` events, which only see Dependabot secrets ([GitHub Actions secrets are not available](https://docs.github.com/en/code-security/reference/supply-chain-security/troubleshoot-dependabot/dependabot-on-actions) in those runs). The sweep job runs on `workflow_run`, `schedule`, and `workflow_dispatch` events, which see regular Actions secrets. Missing either store breaks one of the two merge paths. diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml index fc7d809..3568cae 100644 --- a/.github/workflows/dependabot-automerge.yaml +++ b/.github/workflows/dependabot-automerge.yaml @@ -21,6 +21,7 @@ on: required: true DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY: required: true +permissions: {} # GITHUB_TOKEN is unused; everything runs on the app token. jobs: # Classifies each Dependabot PR with fetch-metadata and records the # verdict as the label. Re-runs on every Dependabot push, so a PR that @@ -28,25 +29,36 @@ jobs: # its label and any previously armed auto-merge. mark: runs-on: ubuntu-latest - permissions: - contents: write # required to toggle auto-merge - pull-requests: write # required to add/remove PR labels - issues: write # required to create repo label if: >- github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]' steps: + # Enabling auto-merge must use an app token, not GITHUB_TOKEN, + # so that CI runs post-merge. + # For simplicity, everything uses this token, instead of some steps + # using GITHUB_TOKEN + - name: Create App Token + id: app-token + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 + with: + app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} + private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} + permission-contents: write # required to toggle auto-merge + permission-pull-requests: write # required to label and approve PRs + permission-issues: write # required to create repo label - name: Fetch Dependabot Metadata id: metadata uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + with: + github-token: ${{ steps.app-token.outputs.token }} - name: Label Eligible PR id: label if: >- steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_URL: ${{ github.event.pull_request.html_url }} REPO: ${{ github.repository }} run: | @@ -57,22 +69,11 @@ jobs: steps.metadata.outputs.update-type != 'version-update:semver-patch' && steps.metadata.outputs.update-type != 'version-update:semver-minor' env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_URL: ${{ github.event.pull_request.html_url }} run: | gh pr edit "${PR_URL}" --remove-label "automerge: eligible" || true gh pr merge --disable-auto "${PR_URL}" || true - # Enabling auto-merge must use an app token, not GITHUB_TOKEN, - # so that CI runs post-merge. - - name: Create App Token - id: app-token - if: inputs.github-auto-merge && steps.label.outcome == 'success' - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2 - with: - app-id: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_ID }} - private-key: ${{ secrets.DEPENDENCY_AUTOMERGE_APP_PRIVATE_KEY }} - permission-contents: write # required to arm auto-merge - permission-pull-requests: write # required to approve PRs - name: Enable Auto-Merge if: inputs.github-auto-merge && steps.label.outcome == 'success' env: @@ -86,7 +87,6 @@ jobs: # workflow_dispatch) live in the caller stub. sweep: runs-on: ubuntu-latest - permissions: {} # GITHUB_TOKEN is unused; everything runs on the app token. if: >- github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||