From 42ea5bbd45995510da392b27cd8e88cdf06dbb57 Mon Sep 17 00:00:00 2001 From: "Piotr P. Karwasz" Date: Fri, 24 Jul 2026 11:45:11 +0200 Subject: [PATCH 1/2] Don't switch to "Draft mode" Since GitHub's June 11, 2026 change "Bot-created pull requests can run workflows if approved"[1], workflows triggered by the "Process Dependabot PR" push are no longer silently dropped, but created in an approval-required state. A maintainer can start the required build checks with the "Approve workflows to run" button, so parking the PR in draft mode is no longer necessary. Also drop the `pull-requests: write` permission, which was only needed to toggle draft mode, and explicitly opt into `persist-credentials` for the checkout, since the changelog commit push relies on it. [1] https://github.blog/changelog/2026-06-11-bot-created-pull-requests-can-run-workflows-if-approved/ Assisted-By: Claude Fable 5 --- .../process-dependabot-reusable.yaml | 23 ++----------------- 1 file changed, 2 insertions(+), 21 deletions(-) diff --git a/.github/workflows/process-dependabot-reusable.yaml b/.github/workflows/process-dependabot-reusable.yaml index 5de06380..c85755c8 100644 --- a/.github/workflows/process-dependabot-reusable.yaml +++ b/.github/workflows/process-dependabot-reusable.yaml @@ -43,8 +43,6 @@ jobs: permissions: # Push changelog commit contents: write - # Switch PR into draft mode - pull-requests: write steps: @@ -79,6 +77,8 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # 7.0.0 with: ref: ${{ steps.pr.outputs.head-ref }} + # The credentials will be used in the "Add & commit changes" step + persist-credentials: true # An action triggered by `workflow_run` has access to secrets. # Checking out untrusted code requires an explicit opt-in. allow-unsafe-pr-checkout: true @@ -141,22 +141,3 @@ jobs: git commit -m "Generate changelog entries for #$PR_ID" git push origin "HEAD:${HEAD_REF}" fi - - # Pushes made with the default `GITHUB_TOKEN` do not trigger workflows (GitHub anti-recursion rule), - # so the required checks will not re-run against the changelog commit pushed above. - # Introducing a PAT is undesirable, so we park the PR in draft mode instead. - # A maintainer must then: - # 1. Approve the PR. - # 2. Mark the PR as “Ready for review”, this fires `ready_for_review`, - # which runs CI against the changelog commit. - # 3. Enable “auto-merge”. - - name: Switch PR into draft mode - shell: bash - env: - GH_TOKEN: ${{ github.token }} - PR_ID: ${{ steps.pr.outputs.id }} - run: | - is_draft=$(gh pr view "$PR_ID" --json isDraft -q .isDraft) - if [ "$is_draft" = "false" ]; then - gh pr ready --undo "$PR_ID" - fi From 8762c2c3ee16ededf4cc26f49e2127ae620cbba8 Mon Sep 17 00:00:00 2001 From: "Piotr P. Karwasz" Date: Fri, 24 Jul 2026 12:33:07 +0200 Subject: [PATCH 2/2] Enable auto-merge instead Since the required build checks can now be started with the "Approve workflows to run" button, restore the pre-#475 behavior of enabling "auto-merge" on the PR: after a maintainer approves the PR and its workflow runs, the PR merges automatically once the required checks pass. Assisted-By: Claude Fable 5 --- .github/workflows/process-dependabot-reusable.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/process-dependabot-reusable.yaml b/.github/workflows/process-dependabot-reusable.yaml index c85755c8..9c7c6b6d 100644 --- a/.github/workflows/process-dependabot-reusable.yaml +++ b/.github/workflows/process-dependabot-reusable.yaml @@ -43,6 +43,8 @@ jobs: permissions: # Push changelog commit contents: write + # Enable auto-merge on the PR + pull-requests: write steps: @@ -141,3 +143,11 @@ jobs: git commit -m "Generate changelog entries for #$PR_ID" git push origin "HEAD:${HEAD_REF}" fi + + - name: Enable auto-merge on PR + shell: bash + env: + GH_TOKEN: ${{ github.token }} + PR_ID: ${{ steps.pr.outputs.id }} + run: | + gh pr merge --squash --auto "$PR_ID"