Skip to content

Simplify: use github.token for all branch updates #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maansaake merged 7 commits into from
May 31, 2026
+10 −26
Merged

Simplify: use github.token for all branch updates #34

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
276f611
Handle UNKNOWN merge state for Dependabot PRs
invalid-email-address May 31, 2026
44c4768
Use GITHUB_TOKEN when posting Dependabot rebase comments
invalid-email-address May 31, 2026
3ab5d5f
Use DEPENDABOT_REBASE_TOKEN (PAT) for Dependabot rebase comments
invalid-email-address May 31, 2026
647d402
Use github-actions[bot] to rebase Dependabot PRs
invalid-email-address May 31, 2026
338e099
Fix indentation in auto-update-pr-branches workflow
invalid-email-address May 31, 2026
1db27a6
Simplify: use github.token for all branch updates
invalid-email-address May 31, 2026
fbf586d
chore: use jeeves token for gh pr update-branch rebase
invalid-email-address May 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 10 additions & 26 deletions .github/workflows/auto-update-pr-branches.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,35 +16,19 @@ jobs:
runs-on: ubuntu-latest
if: github.repository == 'maansaake/arbiter'
steps:
- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
- name: Generate Jeeves app token
id: jeeves-token
uses: actions/create-github-app-token@v1
with:
client-id: ${{ secrets.JEEVES_APP_ID }}
app-id: ${{ secrets.JEEVES_APP_ID }}
private-key: ${{ secrets.JEEVES_APP_PRIVATE_KEY }}

- name: Update out-of-date PR branches
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
GH_TOKEN: ${{ steps.jeeves-token.outputs.token }}
run: |
gh pr list --repo "${{ github.repository }}" --base main --state open --json number,author \
--jq '.[] | "\(.number) \(.author.login)"' | \
while IFS=' ' read -r pr author; do
echo "Checking PR #$pr (author: $author)..."
if [ "$author" = "app/dependabot" ]; then
# Trigger Dependabot to rebase its own branch rather than pushing directly with
# the Jeeves bot token. If Jeeves pushes, dependabot/fetch-metadata fails with
# "PR is not from Dependabot" on the resulting synchronize event, which prevents
# Jeeves from re-approving and re-enabling auto-merge on that PR.
merge_state=$(gh pr view "$pr" --repo "${{ github.repository }}" \
--json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null || echo "ERROR")
if [ "$merge_state" = "BEHIND" ]; then
echo "PR #$pr is behind main, triggering Dependabot rebase"
gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true
else
echo "PR #$pr merge state is '$merge_state', no update needed"
fi
else
gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true
fi
gh pr list --repo "${{ github.repository }}" --base main --state open --json number \
--jq '.[].number' | \
while read -r pr; do
echo "Updating PR #$pr..."
gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true
done