Repository navigation
ci(dependabot): run auto-merge on pull_request instead of pull_request_target - #104
Merged
Merged
Conversation
…t_target GitHub is making pull_request_target blocked by default on public repos; a scheduled brownout on 2026-11-09 already stopped this workflow from starting on every PR. pull_request is GitHub's documented Dependabot auto-merge pattern: a Dependabot run's read-only token is raised by the existing permissions block, and the job needs no secret. The job also checks the repository so forks never run it. The opt-in variable gate is unchanged; if the variable does not reach a Dependabot run, the job skips, so auto-merge stays off. The README's optional PAT now goes in Dependabot secrets, the only ones a Dependabot run can read.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub is moving
pull_request_targetto blocked-by-default on public repos. During today's scheduled brownout, this workflow failed to start (startup_failure) on #101, #102 and #103. The run page says: Workflows are being blocked due to a scheduled brownout of the defaultpull_request_targetprotection for affected public repositories.pull_request, which is GitHub's documented Dependabot auto-merge pattern. A Dependabot run gets a read-onlyGITHUB_TOKEN, which the existingpermissionsblock raises. The job uses no secrets.DEPENDABOT_AUTOMERGEvariable istrue, and the variable is not set today. If the variable ever doesn't reach a Dependabot run, the job skips, so the failure mode is that auto-merge stays off.github.repositorycheck stops forks of this repo from running the job.Expected result: on this PR and on future Dependabot PRs, the workflow shows as skipped instead of failing to start.