Adopt the Hub-Hosted Merge-Bot Caller Stub - #53
Merged
Conversation
The merge-bot's job bodies now live once in the hub as the reusable merge-bot-task.yml, released at 2.0.338, and this repository is the first to reach it rather than carry a copy. The stub keeps the pull_request_target trigger, the per-PR concurrency group, and grants GITHUB_TOKEN no scope, since every write in the task uses the App token. No rules or delete-branch input is set: this repository runs no tracker and keeps the hub's default behavior.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@## develop #53 +/- ##
========================================
Coverage 43.37% 43.37% ========================================
Files 28 28 Lines 3896 3896 Branches 306 306 ========================================
Hits 1690 1690 Misses 2154 2154 Partials 52 52 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
This PR updates PhotoCleaner’s merge-bot GitHub Actions workflow to use the fleet’s hub-hosted reusable workflow (merge-bot-task.yml) pinned to hub release 2.0.338 (20616e0...), replacing the previously in-repo, fully inlined workflow while keeping the same pull_request_target trigger semantics and per-PR concurrency behavior.
Changes:
- Replace the local
merge-bot-pull-request.ymljob implementation with a thinuses:caller toptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@20616e0.... - Preserve
pull_request_targettrigger types and PR-scoped concurrency (includingcancel-in-progress: false). - Explicitly set
permissions: {}in the caller, relying on the hub workflow’s GitHub App token for writes.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Aug 16, 2026
Merged
ptr727 added a commit
to ptr727/ProjectTemplate
that referenced
this pull request
Aug 16, 2026
…ts (#752) ## What - `docs/reusable-workflows.md` Rollout: stage 1 names PhotoCleaner as the pilot, adopted on `develop` in ptr727/PhotoCleaner#53 at `a3158ce` (audit clean on that branch), ticking on promotion to its ground-truth branch per the tracker's own rule, with two proof items (the first `pull_request_target` run resolving the pin and merging a Dependabot PR, and Dependabot bumping the pin). HomeAutomation-Config moves to the operational slot. Stages 2 and 4 put PhotoCleaner first as well. - `TODO.md`: the cluster's pilot line and the sweep entry's outstanding count follow. - `reports/workflow-reuse.md` regenerated at this hub state (PhotoCleaner still counts as a copy there because its ground truth is `main`). ## Why The maintainer chose PhotoCleaner as the first repo to test with: release model, Dependabot, C#, executable and Docker targets, recently converged, so what it shows is the mechanism rather than the repo. The tracker is the record a cold session resumes from, so the choice and its state land in git.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces
.github/workflows/merge-bot-pull-request.ymlwith the fleet caller stub, so the merge-bot's three jobs run from the hub's reusablemerge-bot-task.yml, pinned to hub release2.0.338(20616e0), rather than as a copied 98-line workflow here. Nothing else changes: thepull_request_targettrigger, the per-PR concurrency group, and the two App secrets are the same, and norulesordelete-branchinput is set because this repository runs no tracker and keeps the default behavior.Why
This is the stage-1 pilot of the hub's rollout of hub-hosted reusable workflows (ptr727/ProjectTemplate
docs/reusable-workflows.md"Rollout"). PhotoCleaner is the pilot because it is a release-model repo with Dependabot, C#, executable and Docker targets, and a recent resync with nothing outstanding, so what it shows is the mechanism rather than the repo. The hub audit already reports this file as owing the caller job (missing required job 'merge-bot'), which is the finding this closes.What this pilot proves, and how to read it
The hub cannot prove these itself, so they are recorded here as observed once they happen and copied into the hub tracker:
uses:pin. The firstpull_request_targetrun after this merges either resolvesptr727/ProjectTemplate/.github/workflows/merge-bot-task.yml@20616e0...or fails at workflow load. Evidence is the run URL.developwith--squash. Evidence is the first Dependabot PR after merge, auto-merged, with the run URL.github-actionsecosystem here targets both branches, so the next hub release should produce aBump ptr727/ProjectTemplatePR. Evidence is that PR.The
rulesinput is not exercised here (no tracker), that proof falls to homeassistant-purpleair.Verification
Hub
repo_gate.py --root(eol, eol-coverage, sha-pin with the new pin resolved against GitHub), hubprose_lint.py --diff origin/develop, actionlint. The pre-commit hook ran (.NET Format, no changes).