fix: resolve dependabot auto-merge workflow issues#885
fix: resolve dependabot auto-merge workflow issues#885MitaliBhalla wants to merge 1 commit intoopenshift:mainfrom
Conversation
- Remove invalid 'metadata: read' permission that causes GitHub Actions validation error - Fix auto-merge API endpoint to use correct format with auto_merge parameter - Improve label checking logic to be more permissive for Dependabot PRs - Replace gh CLI commands with curl for better compatibility and consistency - Ensure workflow only runs on upstream repository to prevent fork failures Fixes auto-merge functionality for Dependabot PRs and resolves workflow validation errors.
openshift-ci
bot
added
the
tide/merge-method-squash
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: MitaliBhalla The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
@MitaliBhalla: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #885 +/- ##
=======================================
Coverage 52.91% 52.91%
=======================================
Files 86 86
Lines 6525 6525
=======================================
Hits 3453 3453
Misses 2610 2610
Partials 462 462 🚀 New features to boost your workflow:
|
| -H "Authorization: Bearer $GH_TOKEN" \ | ||
| "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/merge" \ | ||
| -d '{"merge_method":"merge"}') | ||
| "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" \ |
There was a problem hiding this comment.
Have you ever successfully used auto-merge for a PR before, but found it unstable or not working in certain scenarios?
Can see you use the GitHub REST API, I'm not sure whether auto-merge is actually supported. I found this discussion (https://github.com/orgs/community/discussions/24719
), and a recent reply in 2025 suggests it’s still unavailable?
| -H "Accept: application/vnd.github+json" \ | ||
| -H "Authorization: Bearer $GH_TOKEN" \ | ||
| "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ | ||
| -d '{"body":"🚨 **Major Version Update Detected** 🚨\n\nThis PR contains a major version update that requires manual review:\n- **Dependency:** ${{ steps.metadata.outputs.dependency-names }}\n- **Previous version:** ${{ steps.metadata.outputs.previous-version }}\n- **New version:** ${{ steps.metadata.outputs.new-version }}\n\nPlease review the changelog and breaking changes before merging.\n\nAuto-merge has been **disabled** for this PR."}' |
There was a problem hiding this comment.
If dependency name contains " or special characters, it can break JSON structure, may be better to use jq for better handle any JSON Escaping.
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
WalkthroughGitHub Actions workflow for dependabot auto-merge was updated to remove a permission declaration, expand label-based acceptance criteria for auto-merge, switch from the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes ✨ Finishing touches🧪 Generate unit tests (beta)
Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/dependabot-auto-merge.yml (1)
55-60:⚠️ Potential issue | 🔴 CriticalThis API call will fail —
auto_mergeis not a writable field in the REST API.The code uses
PUTto setauto_merge, but:
- The REST API endpoint for pull requests uses
PATCH(notPUT), and even thenauto_mergeis read-only. The endpoint only accepts:title,body,state,base, andmaintainer_can_modify.- To enable auto-merge programmatically, use the GraphQL mutation
enablePullRequestAutoMergeor theghCLI.The simplest fix is to use
gh pr merge --auto:Proposed fix
- # Enable auto-merge using GitHub API (token is automatically masked in logs) - response=$(curl -s -w "%{http_code}" -o /tmp/response.json \ - -X PUT \ - -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer $GH_TOKEN" \ - "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" \ - -d '{"auto_merge":{"merge_method":"merge"}}') - - if [[ "$response" -eq 200 ]]; then - echo "✅ Auto-merge enabled successfully" - cat /tmp/response.json - else - echo "❌ Failed to enable auto-merge. HTTP status: $response" - echo "Response body:" - cat /tmp/response.json - echo "::warning::Could not enable auto-merge due to permissions. PR labeled for manual review." - - # Add a comment to the PR explaining the situation (token is automatically masked) - curl -s -X POST \ - -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer $GH_TOKEN" \ - "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ - -d '{"body":"🤖 **Dependabot Auto-Merge Status**\n\nThis PR meets the criteria for auto-merge but could not be automatically merged due to repository permissions.\n\n**Details:**\n- Update type: ${{ steps.metadata.outputs.update-type }}\n- Dependencies: ${{ steps.metadata.outputs.dependency-names }}\n- Previous version: ${{ steps.metadata.outputs.previous-version }}\n- New version: ${{ steps.metadata.outputs.new-version }}\n\nPlease review and merge manually if appropriate."}' - fi + # Enable auto-merge via gh CLI + if gh pr merge "${{ github.event.pull_request.number }}" --auto --squash; then + echo "✅ Auto-merge enabled successfully" + else + echo "❌ Failed to enable auto-merge" + echo "::warning::Could not enable auto-merge. PR flagged for manual review." + gh pr comment "${{ github.event.pull_request.number }}" \ + --body "🤖 **Dependabot Auto-Merge Status** + +This PR meets the criteria for auto-merge but could not be automatically merged due to repository permissions. + +**Details:** +- Update type: ${{ steps.metadata.outputs.update-type }} +- Dependencies: ${{ steps.metadata.outputs.dependency-names }} +- Previous version: ${{ steps.metadata.outputs.previous-version }} +- New version: ${{ steps.metadata.outputs.new-version }} + +Please review and merge manually if appropriate." + fiNote: The PR is labeled
tide/merge-method-squash, so--squashis the intended merge method rather than"merge".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/dependabot-auto-merge.yml around lines 55 - 60, The workflow is trying to set the read-only auto_merge field via a PUT to the REST pulls endpoint (setting "auto_merge" in the curl payload) which will fail; replace this approach by either calling the GraphQL mutation enablePullRequestAutoMerge for the PR or, simpler, invoke the GitHub CLI to enable auto-merge with the intended method (use gh pr merge --auto --squash for this PR labeled tide/merge-method-squash) instead of using curl with "auto_merge" and PUT.
🧹 Nitpick comments (2)
.github/workflows/dependabot-auto-merge.yml (2)
31-39: Label check is always true — the step is effectively dead code.The job-level
if(line 17) already restricts execution togithub.actor == 'dependabot[bot]', so the fallback on line 35 (github.actor == "dependabot[bot]") is always true. This meanshas-required-labelswill always betrue, and the label checks on lines 33–34 are never decisive.If the intent is to auto-merge all dependabot PRs (patch/minor), you can remove this step entirely. If the intent is to require a label even for dependabot PRs, remove the actor check on line 35.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/dependabot-auto-merge.yml around lines 31 - 39, The conditional that sets has-required-labels is always true because the job-level if already restricts to github.actor == 'dependabot[bot]'; update the if in the block that writes has-required-labels so it actually enforces label checks: either remove the entire step that sets has-required-labels if you intend to auto-merge all Dependabot PRs, or remove the github.actor == "dependabot[bot]" clause from the condition and keep only the two contains(...) checks (for 'area/dependency' and 'dependencies') so the labels are required even for dependabot PRs; modify the shell if that currently contains contains(github.event.pull_request.labels.*.name, 'area/dependency') and contains(..., 'dependencies') accordingly.
86-91: JSON body may break if dependency metadata contains special characters.The interpolated values (
dependency-names, versions) are injected directly into the JSON string. If any value contains",\, or newlines, the JSON payload will be malformed and the API call will fail silently (-sflag suppresses errors).Consider using
jqto safely construct the JSON body, or switch togh pr commentwhich handles escaping:Example with jq
- curl -s -X POST \ - -H "Accept: application/vnd.github+json" \ - -H "Authorization: Bearer $GH_TOKEN" \ - "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ - -d '{"body":"🚨 **Major Version Update Detected** 🚨\n\n..."}' + BODY=$(jq -n --arg dep "${{ steps.metadata.outputs.dependency-names }}" \ + --arg prev "${{ steps.metadata.outputs.previous-version }}" \ + --arg new "${{ steps.metadata.outputs.new-version }}" \ + '{body: "🚨 **Major Version Update Detected** 🚨\n\nThis PR contains a major version update that requires manual review:\n- **Dependency:** \($dep)\n- **Previous version:** \($prev)\n- **New version:** \($new)\n\nPlease review the changelog and breaking changes before merging.\n\nAuto-merge has been **disabled** for this PR."}') + curl -s -X POST \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer $GH_TOKEN" \ + "https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ + -d "$BODY"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/dependabot-auto-merge.yml around lines 86 - 91, The hardcoded JSON in the curl call can break when interpolated variables (steps.metadata.outputs.dependency-names, previous-version, new-version) contain quotes, backslashes, or newlines; update the dependabot-auto-merge.yml step that constructs the comment (the curl -s -X POST block) to build the JSON safely—either: use jq to construct the payload (e.g., jq -n --arg dep "${{ steps.metadata.outputs.dependency-names }}" --arg prev "${{ steps.metadata.outputs.previous-version }}" --arg new "${{ steps.metadata.outputs.new-version }}" '...') and pipe that into curl with --data `@-`, or replace the curl call with gh pr comment which accepts unescaped text and handles escaping for you; ensure you keep the Authorization token usage or use the GH action's built-in authentication when switching to gh.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 55-60: The workflow is trying to set the read-only auto_merge
field via a PUT to the REST pulls endpoint (setting "auto_merge" in the curl
payload) which will fail; replace this approach by either calling the GraphQL
mutation enablePullRequestAutoMerge for the PR or, simpler, invoke the GitHub
CLI to enable auto-merge with the intended method (use gh pr merge --auto
--squash for this PR labeled tide/merge-method-squash) instead of using curl
with "auto_merge" and PUT.
---
Nitpick comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 31-39: The conditional that sets has-required-labels is always
true because the job-level if already restricts to github.actor ==
'dependabot[bot]'; update the if in the block that writes has-required-labels so
it actually enforces label checks: either remove the entire step that sets
has-required-labels if you intend to auto-merge all Dependabot PRs, or remove
the github.actor == "dependabot[bot]" clause from the condition and keep only
the two contains(...) checks (for 'area/dependency' and 'dependencies') so the
labels are required even for dependabot PRs; modify the shell if that currently
contains contains(github.event.pull_request.labels.*.name, 'area/dependency')
and contains(..., 'dependencies') accordingly.
- Around line 86-91: The hardcoded JSON in the curl call can break when
interpolated variables (steps.metadata.outputs.dependency-names,
previous-version, new-version) contain quotes, backslashes, or newlines; update
the dependabot-auto-merge.yml step that constructs the comment (the curl -s -X
POST block) to build the JSON safely—either: use jq to construct the payload
(e.g., jq -n --arg dep "${{ steps.metadata.outputs.dependency-names }}" --arg
prev "${{ steps.metadata.outputs.previous-version }}" --arg new "${{
steps.metadata.outputs.new-version }}" '...') and pipe that into curl with
--data `@-`, or replace the curl call with gh pr comment which accepts unescaped
text and handles escaping for you; ensure you keep the Authorization token usage
or use the GH action's built-in authentication when switching to gh.
3 participants
fix: resolve dependabot auto-merge workflow issues
Fixes auto-merge functionality for Dependabot PRs and resolves workflow validation errors.
What type of PR is this?
What this PR does / Why we need it?
This PR fixes critical issues in the Dependabot auto-merge workflow that were preventing automatic merging of dependency updates:
metadata: readpermission that was causing workflow validation failuresghCLI commands withcurlfor better runner compatibilityThese fixes will enable automatic merging of patch and minor version dependency updates while requiring manual review for major version updates.
Which Jira/Github issue(s) does this PR fix?
Special notes for your reviewer
/pulls/{pull_number}withauto_mergeparameter)area/dependency,dependencies, or any PR fromdependabot[bot]curlfor consistency and better error handlingUnit Test Coverage
Test coverage checks
This PR modifies GitHub Actions workflow configuration only - no application code changes that would require unit tests.
Pre-checks (if applicable)
Workflow changes are backward compatible and will improve existing Dependabot PR handling.
/label tide/merge-method-squash