[TimeToBuildBob]

Problem

Dependabot Auto-merge is failing on master for every triggered run:

##[error]An unexpected error occurred: Bad credentials, HttpError: Bad credentials
    at branchProtectionRules (ridedott/merge-me-action/.../listBranchProtectionRules.ts:54:1)

The workflow calls ridedott/merge-me-action@v2 with secrets.AWBOT_GH_TOKEN, a
Personal Access Token from the @ActivityWatchBot user. That PAT has expired or been
revoked, so the action cannot authenticate. Effect: Dependabot PRs stop auto-merging
and pile up.

Runs: 39324736647, 39324784943, 39324947069, 39325074693, 39325076771, 39325120187.

Fix

Merge Dependabot PRs directly in the trusted workflow_run context with the
repository token instead of an external PAT:

• actions/github-script (pinned to the v9 SHA) calls pulls.merge with
  merge_method: squash and the exact workflow_run.head_sha.
• permissions.pull-requests goes from read to write.
• The job now also requires github.event.workflow_run.event == 'pull_request', so
  master push builds no longer trigger a pointless auto-merge attempt.

This is the same change already shipped for the same expired-PAT failure in
ActivityWatch/aw-webui#901 and ActivityWatch/aw-server-rust#643, so the three repos
stop depending on a token that needs manual rotation.

Verification

• YAML parses; on, permissions, and the job if all read back as intended.
• Behavior is equivalent to the previous action for the intended case (successful
  Build run on a Dependabot PR → squash merge).
• No repository secret is required after this change; AWBOT_GH_TOKEN can be
  retired.

Note: this only takes effect once merged to master, since workflow_run workflows
always execute from the default branch.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The change affects automated dependency merges in this repository.

The PR appears safe to merge, with a non-blocking loss of checks and reports after Dependabot merges.

Findings

1.  Merged commits lose checks ▶

Summary

Replaces the expired PAT-based merge action with github-script and the repository token.

• Passing Dependabot pull-request builds now squash-merge without a bot token.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Build completes] --> B{Successful Dependabot PR run?}
  B -->|No| C[Skip]
  B -->|Yes| D[Fetch associated PR]
  D --> E{Open and not draft?}
  E -->|No| C
  E -->|Yes| F[Squash merge exact built SHA]
  F --> G[Repository token suppresses push workflows]

Loading

_{Reviews (1) · Last reviewed commit: "fix(ci): drop brittle PAT-based dependab..." · Reviewed by Greptile}

[greptile-apps]

Merged commits lose checks

Using GITHUB_TOKEN for pulls.merge stops the resulting push from triggering GitHub Actions. Dependabot merges will skip the master runs of Build, Lint, and CodeQL, including the coverage upload and default-branch CodeQL results. The PR runs still happen, but they do not update those results for the merged commit.

Explicitly trigger the needed follow-up workflows after merging, or use a GitHub App token to keep those push runs automatic.

[TimeToBuildBob]

Fixed in 671d3c9. A confirmed successful merge now explicitly dispatches Build, Lint and CodeQL on the base branch; all three workflows accept workflow_dispatch, and the merge job has actions: write. Missing, closed or draft PRs and failed/rejected merges dispatch nothing. Dispatch-triggered Build runs cannot recurse into automerge because its job requires a pull_request-origin run.

Verified YAML triggers and permissions, plus six local behavioral cases against the actual extracted github-script. actionlint passes after filtering only its pre-existing old-action-runtime warnings; those action upgrades are outside this fix. New-head CI is running. Live post-merge dispatch remains to be verified after this workflow lands on master.