fix: auto-merge workflow permissions and PR detection#4
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughGitHub Actions workflow updated to modify Dependabot PR auto-merge trigger from Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In @.github/workflows/auto-merge-dependabot.yml:
- Around line 3-9: The current workflow uses a pull_request trigger which causes
Dependabot PRs to run with a read-only GITHUB_TOKEN and will make commands like
`gh pr merge` fail; update the workflow trigger and token usage by either
switching the trigger to a follow-up `workflow_run` that runs after the PR is
created (so normal write permissions and secrets are available) or keep a
trigger but replace use of GITHUB_TOKEN for merge operations with a dedicated
token: create a Dependabot-scoped secret (PAT or GitHub App token as a
Dependabot secret) and use that secret for write operations (e.g., the `gh pr
merge` step) instead of GITHUB_TOKEN; ensure you reference the top-level `on:`
block and any steps invoking `gh pr merge` in the workflow when applying the
change.
| on: | ||
| pull_request_target: | ||
| pull_request: | ||
| types: [opened, synchronize, reopened, ready_for_review] | ||
| check_suite: | ||
| types: [completed] | ||
|
|
||
| permissions: | ||
| contents: write | ||
| pull-requests: write |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
GitHub Actions GITHUB_TOKEN read-only dependabot pull_request trigger
💡 Result:
When a workflow is triggered by a Dependabot PR (i.e., github.actor == 'dependabot[bot]') via events like pull_request, GitHub treats it like a forked-PR run for security:
GITHUB_TOKENis read-only by default- Repository Actions secrets are not available (only Dependabot secrets are)
[1]
Even if you switch to pull_request_target, GitHub still forces read-only token + no secrets when the PR’s base ref was created by Dependabot (a hard restriction) [1][2].
What you can do
-
Avoid writes in Dependabot-triggered runs
Run only read-only CI (build/test/lint) onpull_requestand gate any “write” steps. -
Split into two workflows (recommended)
- Workflow A: runs on
pull_request(Dependabot-safe), does checks only. - Workflow B: runs on
workflow_run(after A succeeds) and can run with normal permissions because it’s not executed in the untrusted PR context. (This is the common pattern implied by GitHub’s security model in the changelog.) [3]
- Workflow A: runs on
-
Use a separate credential if you must write
Use a PAT or GitHub App token stored as a Dependabot secret (not an Actions secret), and use that token for write operations. Dependabot runs can access Dependabot secrets [1]. -
If you just need PR metadata/labels/auto-approve
GitHub’s “Automating Dependabot with GitHub Actions” examples show usingpermissions:(e.g.pull-requests: write) onpull_request, but be aware that the Dependabot restrictions above still apply to secrets and token behavior in Dependabot-triggered contexts. [4][1]
Key point: you generally can’t “fix” Dependabot’s read-only GITHUB_TOKEN on pull_request—it’s an intentional platform restriction. Use a split workflow (workflow_run) or a Dependabot secret token when writes are required. [3][1]
Sources
[1] GitHub Docs — “Dependabot on GitHub Actions” (Restrictions when Dependabot triggers events) (docs.github.com)
[2] GitHub Changelog — pull_request_target base-ref-by-Dependabot always read-only/no secrets (github.blog)
[3] GitHub Changelog — Dependabot PR workflows treated like forks; read-only token/no secrets (github.blog)
[4] GitHub Docs — “Automating Dependabot with GitHub Actions” examples using permissions: (docs.github.com)
Citations:
- 1: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-on-actions?utm_source=openai
- 2: https://github.blog/changelog/2021-12-09-github-actions-changes-to-permissions-in-workflows-triggered-by-dependabot/?utm_source=openai
- 3: https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions?utm_source=openai
- 4: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions?utm_source=openai
🏁 Script executed:
find .github/workflows -name "auto-merge-dependabot.yml" -type fRepository: dacrab/solid-studio
Length of output: 106
🏁 Script executed:
cat .github/workflows/auto-merge-dependabot.ymlRepository: dacrab/solid-studio
Length of output: 592
This workflow will fail—Dependabot PRs on pull_request trigger receive a read-only GITHUB_TOKEN, which cannot be overridden by the permissions: block.
When GitHub Actions runs a workflow triggered by a Dependabot PR (identified by github.actor == 'dependabot[bot]'), the GITHUB_TOKEN is automatically downgraded to read-only for security, regardless of the permissions: configuration. The gh pr merge command will fail with a 403 permission error.
Switching to pull_request_target alone won't help—GitHub still restricts Dependabot-triggered workflows to read-only access when the base ref was created by Dependabot.
The recommended solutions are:
- Use
workflow_runtrigger instead: runs after the pull request is fully created, with normal write permissions and access to secrets. - Use a separate token: store a PAT or GitHub App token as a Dependabot secret (not an Actions secret) and use it for write operations.
🤖 Prompt for AI Agents
In @.github/workflows/auto-merge-dependabot.yml around lines 3 - 9, The current
workflow uses a pull_request trigger which causes Dependabot PRs to run with a
read-only GITHUB_TOKEN and will make commands like `gh pr merge` fail; update
the workflow trigger and token usage by either switching the trigger to a
follow-up `workflow_run` that runs after the PR is created (so normal write
permissions and secrets are available) or keep a trigger but replace use of
GITHUB_TOKEN for merge operations with a dedicated token: create a
Dependabot-scoped secret (PAT or GitHub App token as a Dependabot secret) and
use that secret for write operations (e.g., the `gh pr merge` step) instead of
GITHUB_TOKEN; ensure you reference the top-level `on:` block and any steps
invoking `gh pr merge` in the workflow when applying the change.
Fixes auto-merge workflow failures:
check_suitetrigger (doesn't have PR context)pull_requesttrigger onlycontents: writeandpull-requests: writeGH_TOKENandGH_REPOenv vars for gh CLIThis will allow dependabot PRs to auto-merge when CI passes.
Summary by CodeRabbit
Note: This release contains no user-facing changes.