From 5e3799362963129ef9948228c0fcf24cd79cb071 Mon Sep 17 00:00:00 2001 From: jbujula Date: Thu, 13 Aug 2026 18:31:55 -0700 Subject: [PATCH] fix(ci): degrade gracefully when Actions may not open PRs Ports the fix from powerplatform-build-tools#1462. The weekly refresh workflow added in #507 is the same one, so it has the same latent failure. In build-tools the first real run did all of its work -- npm ci, npm update, audit-overrides, build and test -- pushed its branch, and then failed on the last step with: pull request create failed: GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest) That is the org/repo policy "Allow GitHub Actions to create and approve pull requests", not a workflow bug, and no token or permissions change avoids it. Failing the run every week for something the workflow cannot satisfy just teaches people to ignore the job, so the step now distinguishes: - that specific policy error -> ::warning:: plus a job summary with a prefilled compare link and the PR body, exit 0 (branch is pushed and green, so it is one click away), - any other error -> exit 1, unchanged. The gh error is printed either way. Verified in the build-tools PR with a stubbed gh reproducing the exact stderr: policy error -> exit 0 with summary; unrelated error -> exit 1. yaml parses and bash -n is clean on the extracted step here too. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6ac571cd-d84e-4b40-805a-e316a62ed292 --- .github/workflows/dependency-security.yml | 33 ++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependency-security.yml b/.github/workflows/dependency-security.yml index 1b20c27..ee1e612 100644 --- a/.github/workflows/dependency-security.yml +++ b/.github/workflows/dependency-security.yml @@ -107,6 +107,33 @@ jobs: # No --reviewer here: .github/CODEOWNERS already requests a review for every file # this PR touches, and passing a team reviewer explicitly can fail depending on the # GITHUB_TOKEN's permissions. - gh pr create --base main --head "$BRANCH" \ - --title "chore: weekly dependency security refresh" \ - --body-file pr-body.md + # + # Actions cannot open a PR when the org/repo policy "Allow GitHub Actions to create + # and approve pull requests" is disabled. By this point the branch is pushed and the + # build is green, so the work is not lost. Failing the run would put a red X on the + # weekly job every week for a reason nobody can fix from the workflow, which just + # trains people to ignore it. Surface an actionable link instead. + if ! gh pr create --base main --head "$BRANCH" \ + --title "chore: weekly dependency security refresh" \ + --body-file pr-body.md 2> pr-error.log; then + cat pr-error.log >&2 + if grep -q "not permitted to create or approve pull requests" pr-error.log; then + echo "::warning::Branch '$BRANCH' was pushed and is green, but Actions is not allowed to open PRs in this repo. Open it manually, or enable Settings > Actions > General > 'Allow GitHub Actions to create and approve pull requests'." + { + echo "## Dependency refresh is ready, but the PR could not be opened automatically" + echo + echo "Branch \`$BRANCH\` has been pushed and the build passed." + echo + echo "**Open the PR:** https://github.com/${GITHUB_REPOSITORY}/compare/main...${BRANCH}?expand=1" + echo + echo "To let future runs open it themselves, enable **Settings > Actions > General >" + echo "\"Allow GitHub Actions to create and approve pull requests\"**." + echo + echo "---" + echo + cat pr-body.md + } >> "$GITHUB_STEP_SUMMARY" + else + exit 1 + fi + fi