Skip to content

Simplify: use github.token for all branch updates #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maansaake merged 7 commits into from
May 31, 2026
Merged

Simplify: use github.token for all branch updates #14

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3556bc2
Handle UNKNOWN merge state for Dependabot PRs
May 31, 2026
ca3ffac
Use GITHUB_TOKEN when posting Dependabot rebase comments
May 31, 2026
82bc8b5
Use DEPENDABOT_REBASE_TOKEN (PAT) for Dependabot rebase comments
May 31, 2026
0829640
Use github-actions[bot] to rebase Dependabot PRs
May 31, 2026
a793eed
Fix indentation in auto-update-pr-branches workflow
May 31, 2026
8059168
Simplify: use github.token for all branch updates
May 31, 2026
defb858
chore: use jeeves token for gh pr update-branch rebase
May 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 10 additions & 26 deletions .github/workflows/auto-update-pr-branches.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,35 +16,19 @@ jobs:
runs-on: ubuntu-latest
if: github.repository == 'trebent/envparser'
steps:
- name: Generate GitHub App token
id: app-token
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
- name: Generate Jeeves app token
id: jeeves-token
uses: actions/create-github-app-token@v1
with:
client-id: ${{ secrets.JEEVES_APP_ID }}
app-id: ${{ secrets.JEEVES_APP_ID }}
private-key: ${{ secrets.JEEVES_APP_PRIVATE_KEY }}

- name: Update out-of-date PR branches
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
GH_TOKEN: ${{ steps.jeeves-token.outputs.token }}
run: |
gh pr list --repo "${{ github.repository }}" --base main --state open --json number,author \
--jq '.[] | "\(.number) \(.author.login)"' | \
while IFS=' ' read -r pr author; do
echo "Checking PR #$pr (author: $author)..."
if [ "$author" = "app/dependabot" ]; then
# Trigger Dependabot to rebase its own branch rather than pushing directly with
# the Jeeves bot token. If Jeeves pushes, dependabot/fetch-metadata fails with
# "PR is not from Dependabot" on the resulting synchronize event, which prevents
# Jeeves from re-approving and re-enabling auto-merge on that PR.
merge_state=$(gh pr view "$pr" --repo "${{ github.repository }}" \
--json mergeStateStatus --jq '.mergeStateStatus' 2>/dev/null || echo "ERROR")
if [ "$merge_state" = "BEHIND" ]; then
echo "PR #$pr is behind main, triggering Dependabot rebase"
gh pr comment --repo "${{ github.repository }}" "$pr" --body "@dependabot rebase" || true
else
echo "PR #$pr merge state is '$merge_state', no update needed"
fi
else
gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true
fi
gh pr list --repo "${{ github.repository }}" --base main --state open --json number \
--jq '.[].number' | \
while read -r pr; do
echo "Updating PR #$pr..."
gh pr update-branch --rebase --repo "${{ github.repository }}" "$pr" || true
done