Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/merge-bot-pull-request.yml
Original file line numberDiff line numberDiff line change
Expand Up@@ -2,6 +2,7 @@ name: Merge bot pull request action

on:
pull_request:
types: [opened, reopened, synchronize]

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
Expand DownExpand Up@@ -35,7 +36,7 @@ jobs:
merge-codegen:
name: Merge codegen pull request job
runs-on: ubuntu-latest
if: github.event.pull_request.user.login == 'ptr727' && github.event.pull_request.head.ref == 'codegen' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository
if: github.actor == 'ptr727' && github.event.pull_request.user.login == 'ptr727' && github.event.pull_request.head.ref == 'codegen' && github.event.pull_request.base.ref == 'main' && github.event.pull_request.head.repo.full_name == github.repository
permissions:
Comment thread
ptr727 marked this conversation as resolved.
contents: write
pull-requests: write
Expand Down
7 changes: 6 additions & 1 deletion README.md
Original file line numberDiff line numberDiff line change
Expand Up@@ -389,7 +389,12 @@ Licensed under the [MIT License][license-link]\
- Pull requests: Read & write — to create the PR
- Workflows: Read & write — this is the key permission that allows the token to trigger `pull_request` events in other workflows; without it the auto-merge workflow never fires
- Metadata: Read-only (auto-required)
- The auto-merge condition gates on `github.event.pull_request.user.login` matching the PAT owner's GitHub username (`ptr727`), so only PRs created by this token on the `codegen` branch are eligible for auto-merge.
- The auto-merge condition in `merge-bot-pull-request.yml` requires all of the following to be true:
- `github.actor == 'ptr727'` — the event was triggered by the PAT owner (guards against a collaborator pushing to the branch after PR creation)
Comment thread
ptr727 marked this conversation as resolved.
- `github.event.pull_request.user.login == 'ptr727'` — the PR was created by the PAT owner
- `github.event.pull_request.head.ref == 'codegen'` — the source branch is `codegen`
- `github.event.pull_request.base.ref == 'main'` — the PR targets `main`
- `github.event.pull_request.head.repo.full_name == github.repository` — the PR is from the same repository (not a fork)
- Save the PAT as `WORKFLOW_PAT` in:
- GitHub project security Settings / Secrets / Actions.

Expand Down
Loading