From 928fbf8f9dd783f4072deb60d8efe9e2b93939f3 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 5 Apr 2026 15:41:05 -0700 Subject: [PATCH 1/2] Refine auto-merge conditions for codegen pull requests in workflow and update README for clarity Signed-off-by: Pieter Viljoen --- .github/workflows/merge-bot-pull-request.yml | 2 +- README.md | 7 ++++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml index d0221f95..c355c39a 100644 --- a/.github/workflows/merge-bot-pull-request.yml +++ b/.github/workflows/merge-bot-pull-request.yml @@ -35,7 +35,7 @@ jobs: merge-codegen: name: Merge codegen pull request job runs-on: ubuntu-latest - if: github.event.pull_request.user.login == 'ptr727' && github.event.pull_request.head.ref == 'codegen' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository + if: github.actor == 'ptr727' && github.event.pull_request.user.login == 'ptr727' && github.event.pull_request.head.ref == 'codegen' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository permissions: contents: write pull-requests: write diff --git a/README.md b/README.md index c0f9193f..cc02858d 100644 --- a/README.md +++ b/README.md @@ -389,7 +389,12 @@ Licensed under the [MIT License][license-link]\ - Pull requests: Read & write — to create the PR - Workflows: Read & write — this is the key permission that allows the token to trigger `pull_request` events in other workflows; without it the auto-merge workflow never fires - Metadata: Read-only (auto-required) - - The auto-merge condition gates on `github.event.pull_request.user.login` matching the PAT owner's GitHub username (`ptr727`), so only PRs created by this token on the `codegen` branch are eligible for auto-merge. + - The auto-merge condition in `merge-bot-pull-request.yml` requires all of the following to be true: + - `github.actor == 'ptr727'` — the event was triggered by the PAT owner (guards against a collaborator pushing to the branch after PR creation) + - `github.event.pull_request.user.login == 'ptr727'` — the PR was created by the PAT owner + - `github.event.pull_request.head.ref == 'codegen'` — the source branch is `codegen` + - `github.event.pull_request.base.ref == 'main'` — the PR targets `main` + - `github.event.pull_request.head.repo.full_name == github.repository` — the PR is from the same repository (not a fork) - Save the PAT as `WORKFLOW_PAT` in: - GitHub project security Settings / Secrets / Actions. From f6748e4ca8aba9c4c317ad41b9beb0a335ecf856 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sun, 5 Apr 2026 15:45:57 -0700 Subject: [PATCH 2/2] Add pull request types to workflow trigger for merge bot action Signed-off-by: Pieter Viljoen --- .github/workflows/merge-bot-pull-request.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/merge-bot-pull-request.yml b/.github/workflows/merge-bot-pull-request.yml index c355c39a..36b61cda 100644 --- a/.github/workflows/merge-bot-pull-request.yml +++ b/.github/workflows/merge-bot-pull-request.yml @@ -2,6 +2,7 @@ name: Merge bot pull request action on: pull_request: + types: [opened, reopened, synchronize] concurrency: group: ${{ github.workflow }}-${{ github.ref }}