Skip to content

ci(auto-merge): consume reusable workflow from renovate-config #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
github-actions merged 3 commits into from
May 5, 2026
Merged

ci(auto-merge): consume reusable workflow from renovate-config #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fc45bda
ci(auto-merge): consume reusable workflow from renovate-config
ANcpLua May 5, 2026
bc28e16
chore(ci): bump claude-code-review fetch-depth 20 → 100
ANcpLua May 5, 2026
90daa73
Merge branch 'main' into ci/auto-merge-reusable-app-token
ANcpLua May 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
146 changes: 8 additions & 138 deletions .github/workflows/auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
# Auto-merge workflow for trusted PRs
# Thin caller — delegates to the reusable workflow at
# ANcpLua/renovate-config (single source of truth across the framework).
#
# Tiers:
# 1a. Dependabot PRs: Auto-approve + auto-merge for patch/minor
# 1b. Renovate PRs: Auto-approve + auto-merge
# 2. AI Agent fix PRs (copilot/, jules/, claude/): Auto-merge when CI passes
# 3. CodeRabbit approved PRs: Auto-merge when CI passes
# 4. Owner PRs: Auto-merge when CI passes
# Required secrets in this repo:
# AUTOMERGE_APP_ID, AUTOMERGE_APP_PRIVATE_KEY
# See https://github.com/ANcpLua/renovate-config#auto-merge-reusable-workflow

name: Auto-merge

Expand All @@ -20,134 +18,6 @@ permissions:
pull-requests: write

jobs:
dependabot-auto-merge:
name: Dependabot auto-merge
runs-on: ubuntu-latest
if: github.actor == 'dependabot[bot]'

steps:
- name: Fetch Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
with:
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Auto-approve patch and minor updates
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr review --approve "$PR_URL"

- name: Enable auto-merge for patch and minor
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr merge --auto --squash "$PR_URL"

- name: Request Claude review for major updates
if: steps.metadata.outputs.update-type == 'version-update:semver-major'
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
PREV_VERSION: ${{ steps.metadata.outputs.previous-version }}
NEW_VERSION: ${{ steps.metadata.outputs.new-version }}
run: |
gh pr comment "$PR_URL" --body "## ⚠️ Major Version Update

@claude Please review this major version update for breaking changes and merge if safe.

| Dependency | Update |
|------------|--------|
| \`$DEP_NAMES\` | \`$PREV_VERSION\` → \`$NEW_VERSION\` |

Check the changelog and verify compatibility."

renovate-auto-merge:
name: Renovate auto-merge
runs-on: ubuntu-latest
if: github.actor == 'renovate[bot]'

steps:
- name: Auto-approve Renovate PRs
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr review --approve "$PR_URL"

- name: Enable auto-merge for Renovate
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr merge --auto --squash "$PR_URL"

ai-agent-auto-merge:
name: AI Agent auto-merge
runs-on: ubuntu-latest
if: |
(github.actor == 'copilot[bot]' || github.actor == 'jules[bot]' || github.actor == 'claude-code[bot]') &&
(
startsWith(github.event.pull_request.head.ref, 'copilot/') ||
startsWith(github.event.pull_request.head.ref, 'jules/') ||
startsWith(github.event.pull_request.head.ref, 'claude/')
)

steps:
- name: Identify AI agent
id: agent
env:
BRANCH: ${{ github.event.pull_request.head.ref }}
run: |
if [[ "$BRANCH" == copilot/* ]]; then
echo "agent=Copilot" >> "$GITHUB_OUTPUT"
elif [[ "$BRANCH" == jules/* ]]; then
echo "agent=Jules" >> "$GITHUB_OUTPUT"
elif [[ "$BRANCH" == claude/* ]]; then
echo "agent=Claude" >> "$GITHUB_OUTPUT"
fi

- name: Auto-approve AI agent PRs
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
AGENT: ${{ steps.agent.outputs.agent }}
run: |
echo "Auto-approving $AGENT PR"
gh pr review --approve "$PR_URL" --body "✅ Auto-approved: $AGENT autonomous fix PR"

- name: Enable auto-merge for AI agent PRs
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr merge --auto --squash "$PR_URL"

coderabbit-auto-merge:
name: CodeRabbit auto-merge
runs-on: ubuntu-latest
if: |
github.event_name == 'pull_request_review' &&
github.event.review.state == 'approved' &&
github.event.review.user.login == 'coderabbitai[bot]'

steps:
- name: Enable auto-merge for CodeRabbit approved PRs
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr merge --auto --squash "$PR_URL"

owner-auto-merge:
name: Owner auto-merge
runs-on: ubuntu-latest
if: |
github.event.pull_request.user.login == github.event.repository.owner.login &&
github.event.pull_request.draft == false

steps:
- name: Enable auto-merge for owner PRs
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr merge --auto --squash "$PR_URL"
auto-merge:
uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main

@chatgpt-codex-connector chatgpt-codex-connector Bot May 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pin reusable workflow to immutable commit SHA

Calling ANcpLua/renovate-config via @main makes this privileged auto-merge path mutable at runtime: any future push to that branch immediately changes behavior here without a review in this repository. Because this workflow grants write permissions and drives merge automation, it should be pinned to a specific commit SHA to prevent supply-chain drift or takeover from silently altering merge logic.

Useful? React with 👍 / 👎.

@coderabbitai coderabbitai Bot May 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Blocking: reusable workflow must be SHA-pinned, not branch-pinned.

@main is mutable. Pin to a full commit SHA to prevent supply-chain drift and satisfy the SHA-pinning policy for external workflow references.

-    uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main
+    uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<FULL_SHA>

As per coding guidelines: "Pin third-party actions to SHA. First-party (actions/*) tag-pin OK."

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-merge.yml at line 22, Change the reusable workflow
reference from a branch tag to a full commit SHA: replace the current uses
string "ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main"
with the same path pinned to the repository commit SHA (e.g.
@<full-commit-sha>); locate the uses entry in the workflow and update it,
obtaining the commit SHA from the remote repo (GitHub UI or git ls-remote) and
commit the change so the workflow references an immutable SHA.

secrets: inherit

@chatgpt-codex-connector chatgpt-codex-connector Bot May 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Pass only required secrets instead of inheriting all

Using secrets: inherit forwards all repository/organization secrets from the caller workflow to the called workflow, even though this workflow documents only two required secrets. In this cross-repo reusable-workflow setup, broad inheritance unnecessarily expands blast radius if the called workflow is modified or compromised; pass only the specific secrets needed for auto-merge.

Useful? React with 👍 / 👎.

2 changes: 1 addition & 1 deletion .github/workflows/claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ github.event.pull_request.head.ref }}
fetch-depth: 20
fetch-depth: 100

- name: Run Claude Code Review (agentic)
id: claude-review
Expand Down
Loading