Skip to content

fix(dependabot-rebase): fall back to @dependabot rebase when update-branch is blocked by workflows permission #143

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 2 commits into from
Apr 17, 2026
Merged

fix(dependabot-rebase): fall back to @dependabot rebase when update-branch is blocked by workflows permission #143

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9ef30a5
fix(dependabot-rebase): fall back to @dependabot rebase when update-b…
Apr 16, 2026
f65f095
fix(dependabot-rebase): address review comments on workflows-403 fall…
Apr 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 22 additions & 7 deletions .github/workflows/dependabot-rebase-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,10 +91,28 @@ jobs:

if [[ "$BEHIND" -gt 0 ]]; then
echo "PR #$PR_NUMBER ($HEAD_REF) is $BEHIND commit(s) behind — merging main into branch"
if gh api "repos/$REPO/pulls/$PR_NUMBER/update-branch" \
-X PUT -f update_method=merge \
--silent; then
echo " Branch updated"
UPDATE_OUTPUT=$(gh api "repos/$REPO/pulls/$PR_NUMBER/update-branch" \
-X PUT -f update_method=merge 2>&1)
UPDATE_EXIT=$?
if [[ $UPDATE_EXIT -ne 0 ]]; then
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
echo "$UPDATE_OUTPUT"
if echo "$UPDATE_OUTPUT" | grep -q "workflows.*permission\|without.*permission"; then
Comment thread
don-petry marked this conversation as resolved.
Outdated
# GitHub blocks update-branch when the merge would add .github/workflows/
# changes, because the token lacks 'workflows' write permission. This applies
# to all tokens (GITHUB_TOKEN and GitHub App tokens alike).
# Fallback: post @dependabot rebase so Dependabot rebases its own branch —
# Dependabot has the necessary permissions. After rebase, the automerge
# workflow fires (pull_request_target/synchronize) and re-approves.
echo " update-branch blocked (workflows permission) — posting @dependabot rebase as fallback"
GH_TOKEN="$APP_TOKEN" gh pr comment "$PR_NUMBER" --repo "$REPO" \
--body "@dependabot rebase"
Comment thread
don-petry marked this conversation as resolved.
Outdated
Comment thread
don-petry marked this conversation as resolved.
Outdated
else
echo "Warning: failed to update PR #$PR_NUMBER"
fi
continue
fi
if [[ -n "$UPDATE_OUTPUT" ]]; then echo "$UPDATE_OUTPUT"; fi
echo " Branch updated"
# Only re-approve if auto-merge is enabled. Auto-merge is set exclusively
# by the dependabot-automerge workflow after confirming eligibility (patch/
# minor updates or GitHub Actions). This guards against re-approving PRs
Expand Down Expand Up @@ -122,9 +140,6 @@ jobs:
else
echo " Skipping re-approval — auto-merge not enabled (PR may require human review)"
fi
else
echo "Warning: failed to update PR #$PR_NUMBER"
fi
continue
fi

Expand Down
Loading