From 58c900b83ebe60fec98313cc622a2ee273129063 Mon Sep 17 00:00:00 2001 From: Levy Tate <78818969+iLevyTate@users.noreply.github.com> Date: Mon, 9 Nov 2026 12:53:11 -0500 Subject: [PATCH] ci(dependabot): run auto-merge on pull_request instead of pull_request_target GitHub is making pull_request_target blocked by default on public repos; a scheduled brownout on 2026-11-09 already stopped this workflow from starting on every PR. pull_request is GitHub's documented Dependabot auto-merge pattern: a Dependabot run's read-only token is raised by the existing permissions block, and the job needs no secret. The job also checks the repository so forks never run it. The opt-in variable gate is unchanged; if the variable does not reach a Dependabot run, the job skips, so auto-merge stays off. The README's optional PAT now goes in Dependabot secrets, the only ones a Dependabot run can read. --- .github/WORKFLOW_README.md | 5 ++++- .github/workflows/dependabot-automerge.yml | 16 ++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/WORKFLOW_README.md b/.github/WORKFLOW_README.md index 30a74a0..bb1b533 100644 --- a/.github/WORKFLOW_README.md +++ b/.github/WORKFLOW_README.md @@ -15,6 +15,8 @@ This repository is configured with automated dependency updates and release buil ### 2. Dependabot Auto-merge (`.github/workflows/dependabot-automerge.yml`) - **Off unless the repo Variable `DEPENDABOT_AUTOMERGE` is `true`.** +- Runs on `pull_request` (GitHub's documented Dependabot pattern), not `pull_request_target`, which + GitHub is blocking by default on public repos. - When on, enables GitHub auto-merge (squash) for patch and minor Dependabot updates; major updates wait for manual review. - Auto-merge waits only for checks that branch protection marks **required**. With no required @@ -24,7 +26,8 @@ This repository is configured with automated dependency updates and release buil **Optional Setup**: If your repository has branch protection requiring PR approval: 1. Create a Personal Access Token (PAT) with `repo` scope -2. Add it as a repository secret named `DEPENDABOT_PAT` +2. Add it as a **Dependabot** secret named `DEPENDABOT_PAT` (Settings → Secrets and variables → + Dependabot); runs triggered by Dependabot cannot read ordinary Actions secrets 3. Uncomment the auto-approve step in the workflow ### 3. CI (`.github/workflows/ci.yml`) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 743e7fe..06c7727 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,6 +1,13 @@ name: Dependabot Auto-merge +# `pull_request`, not `pull_request_target`: this is GitHub's documented +# Dependabot auto-merge pattern, and GitHub is making pull_request_target +# blocked by default on public repos (a scheduled brownout already stopped this +# workflow from starting on 2026-11-09). A Dependabot-triggered run gets a +# read-only GITHUB_TOKEN that the `permissions` block below raises, and only +# Dependabot secrets; the job needs neither a secret nor the base-branch +# context that pull_request_target existed for. on: - pull_request_target: + pull_request: types: [opened, synchronize, reopened, ready_for_review] permissions: @@ -19,9 +26,14 @@ jobs: # when main has no rule requiring the CI checks, GitHub auto-merge has # nothing to wait for and merges the moment it is enabled (PRs #5, #6 # and #8 merged ~12 s after opening, before CI started). Turn it on only - # after main requires the CI checks to pass. + # after main requires the CI checks to pass. If the variable ever does not + # reach a Dependabot-triggered run, the condition is false and the job + # skips, so the failure mode is "auto-merge off", never "merge unchecked". + # + # The repository check keeps forks of this repo from running the job. if: >- vars.DEPENDABOT_AUTOMERGE == 'true' && + github.repository == 'iLevyTate/StratoSortStack' && github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest steps: