ci(contributors): enable auto-merge instead of forcing --admin#6340
Merged
Conversation
The daily "Update Contributors & Star History" job created its PR with the default GITHUB_TOKEN and then ran `gh pr merge --admin`. Both halves were broken: - The `main` ruleset requires the "CI Gate" status check and its bypass_actors list is empty, so no actor — not even with --admin — can bypass it. The merge failed with "Required status check 'CI Gate' is expected" because CI had not reported yet. - Branch pushes made by GITHUB_TOKEN do not trigger `on: pull_request` workflows, so CI Gate never ran on the PR on its own; a human had to re-trigger CI and merge by hand every day. Create the PR with the WEBSITE_REPO_TOKEN PAT so the push triggers CI, and enable auto-merge (--auto) so GitHub squash-merges once CI Gate passes (0 approvals required). No more daily manual intervention.
houko
enabled auto-merge (squash)
June 26, 2026 12:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The daily
Update Contributors & Star Historyworkflow'sAuto-merge PRstep fails every run (e.g. run 28233594935):Two independent root causes, both confirmed against the live repo config:
--admincannot bypass themainruleset. The ruleset requires theCI Gatestatus check and itsbypass_actorslist is empty, so no actor — not even an admin token — can force the merge whileCI Gateis still in theexpected(unreported) state.CI Gatenever runs on the PR on its own. The PR was created with the defaultGITHUB_TOKEN, and branch pushes made byGITHUB_TOKENdo not triggeron: pull_requestworkflows (GitHub's recursion guard). SoCI Gatestaysexpectedforever, and a maintainer had to manually re-trigger CI and merge by hand each day (PR docs: update contributors and star history #6337 was merged manually by a human at 11:43, ~48 min after the bot's failed attempt).Fix
WEBSITE_REPO_TOKENPAT instead of the defaultGITHUB_TOKEN, so the push triggerson: pull_requestCI andCI Gateactually runs.gh pr merge --adminwithgh pr merge --auto. GitHub squash-merges the PR automatically onceCI Gatepasses (the ruleset requires 0 approvals and allows the squash method), respecting the ruleset instead of fighting it.Net effect: the daily contributors/star-history update merges itself with no manual intervention.
Verification
python3 -c "import yaml; yaml.safe_load(...)"— workflow YAML parses.gh api repos/librefang/librefang/rulesets/13809063: single required checkCI Gate,bypass_actors: [],required_approving_review_count: 0,allowed_merge_methodsincludessquash.allow_auto_merge: true,allow_squash_merge: true,delete_branch_on_merge: true.WEBSITE_REPO_TOKENconfirmed present in repo secrets.workflow_dispatch) run of the job.