From c683a5e4c91ec403cd2ae9256eff8ef35ab16b9b Mon Sep 17 00:00:00 2001
From: GitHub Copilot <copilot@github.com>
Date: Sun, 31 May 2026 22:16:09 +0200
Subject: [PATCH 1/2] Simplify: use github.token for all branch updates

The Jeeves app token was only needed to comment @dependabot rebase on
Dependabot PRs, but GitHub App bots cannot be repository collaborators
so Dependabot always rejected those comments.

The solution was to use github.token (github-actions[bot]) for the
update-branch call instead. Since all PRs now use the same token and
the same mechanism, there is no need to distinguish by author or to
generate a Jeeves app token at all.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../workflows/auto-update-pr-branches.yaml    | 38 +++----------------
 1 file changed, 6 insertions(+), 32 deletions(-)

diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml
index 9c218b3..c8d9693 100644
--- a/.github/workflows/auto-update-pr-branches.yaml
+++ b/.github/workflows/auto-update-pr-branches.yaml
@@ -16,39 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'maansaake/github-actions-help'
     steps:
-      - name: Generate GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.JEEVES_APP_ID }}
-          private-key: ${{ secrets.JEEVES_APP_PRIVATE_KEY }}
-
       - name: Update out-of-date PR branches
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ github.token }}
         run: |
-          gh pr list --repo "${{ github.repository }}" --base main --state open --json number,author \
-            --jq '.[] | "\(.number) \(.author.login)"' | \
-          while IFS=' ' read -r pr author; do
-            echo "Checking PR #$pr (author: $author)..."
-            if [ "$author" = "app/dependabot" ]; then
-              # Trigger Dependabot to rebase its own branch rather than pushing directly with
-              # the Jeeves bot token. If Jeeves pushes, dependabot/fetch-metadata fails with
-              # "PR is not from Dependabot" on the resulting synchronize event, which prevents
-              # Jeeves from re-approving and re-enabling auto-merge on that PR.
-              merge_state=$(gh pr view "$pr" --repo "${{ github.repository }}" \
-                --json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null || echo "ERROR")
-              
-              if [ "$merge_state" = "BEHIND" ]; then
-                echo "PR #$pr is behind main, triggering Dependabot rebase"
-                gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true
-              elif [ "$merge_state" = "UNKNOWN" ]; then
-                echo "PR #$pr state UNKNOWN, triggering Dependabot rebase anyway to be safe"
-                gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true
-              else
-                echo "PR #$pr merge state is '$merge_state', no update needed"
-              fi
-            else
-              gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true
-            fi
+          gh pr list --repo "${{ github.repository }}" --base main --state open --json number \
+            --jq '.[].number' | \
+          while read -r pr; do
+            echo "Updating PR #$pr..."
+            gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true
           done

From aa562181df1b59c198b587d78f7a447748a22ec6 Mon Sep 17 00:00:00 2001
From: GitHub Copilot <copilot@github.com>
Date: Sun, 31 May 2026 22:21:25 +0200
Subject: [PATCH 2/2] chore: use jeeves token for gh pr update-branch rebase

Use Jeeves app token (actions/create-github-app-token) instead of
github.token so that the rebase push triggers downstream workflows.
Branch updates are performed with gh pr update-branch --rebase via CLI,
not by commenting on the PR.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/auto-update-pr-branches.yaml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-update-pr-branches.yaml b/.github/workflows/auto-update-pr-branches.yaml
index c8d9693..5bb3d9c 100644
--- a/.github/workflows/auto-update-pr-branches.yaml
+++ b/.github/workflows/auto-update-pr-branches.yaml
@@ -16,9 +16,15 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'maansaake/github-actions-help'
     steps:
+      - name: Generate Jeeves app token
+        id: jeeves-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.JEEVES_APP_ID }}
+          private-key: ${{ secrets.JEEVES_APP_PRIVATE_KEY }}
       - name: Update out-of-date PR branches
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ steps.jeeves-token.outputs.token }}
         run: |
           gh pr list --repo "${{ github.repository }}" --base main --state open --json number \
             --jq '.[].number' | \