From 276f61149dcbb434fa9f65d214f92761cc41a208 Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Sun, 31 May 2026 21:53:29 +0200 Subject: [PATCH 1/7] Handle UNKNOWN merge state for Dependabot PRs Trigger a Dependabot rebase when mergeStateStatus is UNKNOWN in addition to BEHIND, matching the behaviour in github-actions-help. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/auto-update-pr-branches.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml index 9e3361e..e692150 100644 --- a/.github/workflows/auto-update-pr-branches.yaml +++ b/.github/workflows/auto-update-pr-branches.yaml @@ -41,6 +41,9 @@ jobs: if [ "$merge_state" = "BEHIND" ]; then echo "PR #$pr is behind main, triggering Dependabot rebase" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true + elif [ "$merge_state" = "UNKNOWN" ]; then + echo "PR #$pr state UNKNOWN, triggering Dependabot rebase anyway to be safe" + gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true else echo "PR #$pr merge state is '$merge_state', no update needed" fi From 44c4768fb07cdd2f5cdaaf6ce9d57368730f3052 Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Sun, 31 May 2026 21:57:52 +0200 Subject: [PATCH 2/7] Use GITHUB_TOKEN when posting Dependabot rebase comments Dependabot only accepts commands from accounts with push access. The Jeeves app token is not recognised as such in all repos, causing "Sorry, only users with push access can use that command". Use the vanilla github.token (github-actions[bot]) for the comment so Dependabot accepts it, while keeping the Jeeves token for gh pr update-branch on non-Dependabot PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/auto-update-pr-branches.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml index e692150..84767f6 100644 --- a/.github/workflows/auto-update-pr-branches.yaml +++ b/.github/workflows/auto-update-pr-branches.yaml @@ -26,6 +26,7 @@ jobs: - name: Update out-of-date PR branches env: GH_TOKEN: ${{ steps.app-token.outputs.token }} + VANILLA_GH_TOKEN: ${{ github.token }} run: | gh pr list --repo "${{ github.repository }}" --base main --state open --json number,author \ --jq '.[] | "\(.number) \(.author.login)"' | \ @@ -40,10 +41,10 @@ jobs: --json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null || echo "ERROR") if [ "$merge_state" = "BEHIND" ]; then echo "PR #$pr is behind main, triggering Dependabot rebase" - gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true + GH_TOKEN="$VANILLA_GH_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true elif [ "$merge_state" = "UNKNOWN" ]; then echo "PR #$pr state UNKNOWN, triggering Dependabot rebase anyway to be safe" - gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true + GH_TOKEN="$VANILLA_GH_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true else echo "PR #$pr merge state is '$merge_state', no update needed" fi From 3ab5d5f7a4390cbc1f3d6b634c5370181dbe99f5 Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Sun, 31 May 2026 22:04:39 +0200 Subject: [PATCH 3/7] Use DEPENDABOT_REBASE_TOKEN (PAT) for Dependabot rebase comments Dependabot checks the author_association of comments and only accepts commands from OWNER, MEMBER, or COLLABORATOR. Both github-actions[bot] and GitHub App bots get author_association NONE, so their comments are rejected. Use a PAT from a user with write access (stored as DEPENDABOT_REBASE_TOKEN) so comments are posted as that user and Dependabot accepts them. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/auto-update-pr-branches.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml index 84767f6..b1fe15a 100644 --- a/.github/workflows/auto-update-pr-branches.yaml +++ b/.github/workflows/auto-update-pr-branches.yaml @@ -26,7 +26,7 @@ jobs: - name: Update out-of-date PR branches env: GH_TOKEN: ${{ steps.app-token.outputs.token }} - VANILLA_GH_TOKEN: ${{ github.token }} + DEPENDABOT_REBASE_TOKEN: ${{ secrets.DEPENDABOT_REBASE_TOKEN }} run: | gh pr list --repo "${{ github.repository }}" --base main --state open --json number,author \ --jq '.[] | "\(.number) \(.author.login)"' | \ @@ -41,10 +41,10 @@ jobs: --json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null || echo "ERROR") if [ "$merge_state" = "BEHIND" ]; then echo "PR #$pr is behind main, triggering Dependabot rebase" - GH_TOKEN="$VANILLA_GH_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true + GH_TOKEN="$DEPENDABOT_REBASE_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true elif [ "$merge_state" = "UNKNOWN" ]; then echo "PR #$pr state UNKNOWN, triggering Dependabot rebase anyway to be safe" - GH_TOKEN="$VANILLA_GH_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true + GH_TOKEN="$DEPENDABOT_REBASE_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true else echo "PR #$pr merge state is '$merge_state', no update needed" fi From 647d4021655ee96b9e695216af811227cba10770 Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Sun, 31 May 2026 22:13:10 +0200 Subject: [PATCH 4/7] Use github-actions[bot] to rebase Dependabot PRs Posting @dependabot rebase comments requires OWNER/MEMBER/COLLABORATOR author_association, which GitHub App bots cannot have (GitHub rejects adding bot accounts as collaborators). Instead, use github.token (github-actions[bot]) to call update-branch for Dependabot PRs. This separates the pusher (github-actions[bot]) from the approver (mr-jeeves[bot]), so GitHub does not block Jeeves from approving the resulting synchronize event. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../workflows/auto-update-pr-branches.yaml | 20 ++++++++----------- 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml index b1fe15a..c61ac09 100644 --- a/.github/workflows/auto-update-pr-branches.yaml +++ b/.github/workflows/auto-update-pr-branches.yaml @@ -26,29 +26,25 @@ jobs: - name: Update out-of-date PR branches env: GH_TOKEN: ${{ steps.app-token.outputs.token }} - DEPENDABOT_REBASE_TOKEN: ${{ secrets.DEPENDABOT_REBASE_TOKEN }} + UPDATE_BRANCH_TOKEN: ${{ github.token }} run: | gh pr list --repo "${{ github.repository }}" --base main --state open --json number,author \ --jq '.[] | "\(.number) \(.author.login)"' | \ while IFS=' ' read -r pr author; do echo "Checking PR #$pr (author: $author)..." if [ "$author" = "app/dependabot" ]; then - # Trigger Dependabot to rebase its own branch rather than pushing directly with - # the Jeeves bot token. If Jeeves pushes, dependabot/fetch-metadata fails with - # "PR is not from Dependabot" on the resulting synchronize event, which prevents - # Jeeves from re-approving and re-enabling auto-merge on that PR. + # Use github.token (github-actions[bot]) rather than the Jeeves token so that + # Jeeves (mr-jeeves[bot]) remains free to approve the resulting synchronize event. + # GitHub blocks a bot from approving commits it pushed itself. merge_state=$(gh pr view "$pr" --repo "${{ github.repository }}" \ --json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null || echo "ERROR") - if [ "$merge_state" = "BEHIND" ]; then - echo "PR #$pr is behind main, triggering Dependabot rebase" - GH_TOKEN="$DEPENDABOT_REBASE_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true - elif [ "$merge_state" = "UNKNOWN" ]; then - echo "PR #$pr state UNKNOWN, triggering Dependabot rebase anyway to be safe" - GH_TOKEN="$DEPENDABOT_REBASE_TOKEN" gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true + if [ "$merge_state" = "BEHIND" ] || [ "$merge_state" = "UNKNOWN" ]; then + echo "PR #$pr merge state is '$merge_state', rebasing via github-actions[bot]" + GH_TOKEN="$UPDATE_BRANCH_TOKEN" gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true else echo "PR #$pr merge state is '$merge_state', no update needed" fi - else + else gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true fi done From 338e0994fdc77816f094f8793a74690c02ca0862 Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Sun, 31 May 2026 22:13:53 +0200 Subject: [PATCH 5/7] Fix indentation in auto-update-pr-branches workflow Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/auto-update-pr-branches.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml index c61ac09..ab17e69 100644 --- a/.github/workflows/auto-update-pr-branches.yaml +++ b/.github/workflows/auto-update-pr-branches.yaml @@ -44,7 +44,7 @@ jobs: else echo "PR #$pr merge state is '$merge_state', no update needed" fi - else + else gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true fi done From 1db27a611274cd1065ccc47cea926b2d2d63f08b Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Sun, 31 May 2026 22:16:02 +0200 Subject: [PATCH 6/7] Simplify: use github.token for all branch updates The Jeeves app token was only needed to comment @dependabot rebase on Dependabot PRs, but GitHub App bots cannot be repository collaborators so Dependabot always rejected those comments. The solution was to use github.token (github-actions[bot]) for the update-branch call instead. Since all PRs now use the same token and the same mechanism, there is no need to distinguish by author or to generate a Jeeves app token at all. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .../workflows/auto-update-pr-branches.yaml | 34 ++++--------------- 1 file changed, 6 insertions(+), 28 deletions(-) diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml index ab17e69..d1d11d2 100644 --- a/.github/workflows/auto-update-pr-branches.yaml +++ b/.github/workflows/auto-update-pr-branches.yaml @@ -16,35 +16,13 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'maansaake/arbiter' steps: - - name: Generate GitHub App token - id: app-token - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 - with: - client-id: ${{ secrets.JEEVES_APP_ID }} - private-key: ${{ secrets.JEEVES_APP_PRIVATE_KEY }} - - name: Update out-of-date PR branches env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} - UPDATE_BRANCH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ github.token }} run: | - gh pr list --repo "${{ github.repository }}" --base main --state open --json number,author \ - --jq '.[] | "\(.number) \(.author.login)"' | \ - while IFS=' ' read -r pr author; do - echo "Checking PR #$pr (author: $author)..." - if [ "$author" = "app/dependabot" ]; then - # Use github.token (github-actions[bot]) rather than the Jeeves token so that - # Jeeves (mr-jeeves[bot]) remains free to approve the resulting synchronize event. - # GitHub blocks a bot from approving commits it pushed itself. - merge_state=$(gh pr view "$pr" --repo "${{ github.repository }}" \ - --json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null || echo "ERROR") - if [ "$merge_state" = "BEHIND" ] || [ "$merge_state" = "UNKNOWN" ]; then - echo "PR #$pr merge state is '$merge_state', rebasing via github-actions[bot]" - GH_TOKEN="$UPDATE_BRANCH_TOKEN" gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true - else - echo "PR #$pr merge state is '$merge_state', no update needed" - fi - else - gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true - fi + gh pr list --repo "${{ github.repository }}" --base main --state open --json number \ + --jq '.[].number' | \ + while read -r pr; do + echo "Updating PR #$pr..." + gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true done From fbf586da198a7ab9a0c85f9162366af5fc8e2abf Mon Sep 17 00:00:00 2001 From: GitHub Copilot Date: Sun, 31 May 2026 22:21:25 +0200 Subject: [PATCH 7/7] chore: use jeeves token for gh pr update-branch rebase Use Jeeves app token (actions/create-github-app-token) instead of github.token so that the rebase push triggers downstream workflows. Branch updates are performed with gh pr update-branch --rebase via CLI, not by commenting on the PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/auto-update-pr-branches.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml index d1d11d2..27157de 100644 --- a/.github/workflows/auto-update-pr-branches.yaml +++ b/.github/workflows/auto-update-pr-branches.yaml @@ -16,9 +16,15 @@ jobs: runs-on: ubuntu-latest if: github.repository == 'maansaake/arbiter' steps: + - name: Generate Jeeves app token + id: jeeves-token + uses: actions/create-github-app-token@v1 + with: + app-id: ${{ secrets.JEEVES_APP_ID }} + private-key: ${{ secrets.JEEVES_APP_PRIVATE_KEY }} - name: Update out-of-date PR branches env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.jeeves-token.outputs.token }} run: | gh pr list --repo "${{ github.repository }}" --base main --state open --json number \ --jq '.[].number' | \