From eb37b6efc8fe567a6cd5c1b02195aa58b0c01cd0 Mon Sep 17 00:00:00 2001 From: Bob Date: Mon, 19 Oct 2026 21:36:23 +0000 Subject: [PATCH 1/2] fix(ci): drop brittle PAT-based dependabot automerge The Dependabot Auto-merge workflow used ridedott/merge-me-action with the AWBOT_GH_TOKEN secret. That PAT is expired, so every triggered run fails with "Bad credentials" and Dependabot PRs no longer auto-merge. Merge directly in the trusted workflow_run context with the repository token instead. Also require workflow_run.event == 'pull_request' so master push builds are skipped. Same change as ActivityWatch/aw-webui#901 and ActivityWatch/aw-server-rust#643. Git-Session-Id: 542379d1-1c80-59bc-8b62-6115fac2183f --- .github/workflows/dependabot-automerge.yml | 52 +++++++++++++++++++--- 1 file changed, 46 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 6a5ea1c4..e4c0ac79 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -1,7 +1,13 @@ name: Dependabot Auto-merge -# NOTE: This workflow relies on a Personal Access Token from the @ActivityWatchBot user -# See this issue for details: https://github.com/ridedott/merge-me-action/issues/1581 +# Run in the trusted `workflow_run` context and merge Dependabot PRs directly +# with the repository token instead of depending on an external PAT. +# +# The previous implementation used `ridedott/merge-me-action` with the +# `AWBOT_GH_TOKEN` secret. That PAT expired, so every run failed with +# "Bad credentials" (2026-10-19). The repository token needs no rotation and is +# scoped to this run. Same change as ActivityWatch/aw-webui#901 and +# ActivityWatch/aw-server-rust#643. on: workflow_run: @@ -13,15 +19,49 @@ on: permissions: contents: write - pull-requests: read + pull-requests: write jobs: auto_merge: name: Auto-merge runs-on: ubuntu-latest - if: github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]' + if: >- + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'pull_request' && + github.actor == 'dependabot[bot]' steps: - - uses: ridedott/merge-me-action@v2 + - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 with: - GITHUB_TOKEN: ${{ secrets.AWBOT_GH_TOKEN }} + script: | + const pr = context.payload.workflow_run.pull_requests?.[0]; + if (!pr) { + core.setFailed("No pull request found in workflow_run payload."); + return; + } + + const { data: pull } = await github.rest.pulls.get({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: pr.number, + }); + + if (pull.state !== "open") { + core.info(`PR #${pull.number} is already ${pull.state}; nothing to do.`); + return; + } + + if (pull.draft) { + core.info(`PR #${pull.number} is a draft; skipping.`); + return; + } + + await github.rest.pulls.merge({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: pull.number, + merge_method: "squash", + sha: context.payload.workflow_run.head_sha, + }); + + core.info(`Merged Dependabot PR #${pull.number}.`); From 671d3c95dc83fddb8867f455e7a6ca039fa07c55 Mon Sep 17 00:00:00 2001 From: Bob Date: Mon, 19 Oct 2026 21:49:48 +0000 Subject: [PATCH 2/2] fix(ci): dispatch default-branch checks after token merges Git-Session-Id: 7398bd5f-c85f-5672-bdad-b145f953d55f --- .github/workflows/build.yml | 1 + .github/workflows/codeql.yml | 1 + .github/workflows/dependabot-automerge.yml | 21 +++++++++++++++++++-- .github/workflows/lint.yml | 1 + 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 79b421b3..3eeb17ae 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,6 +1,7 @@ name: Build on: + workflow_dispatch: push: branches: [ master ] pull_request: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 30c1b423..9029c183 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -1,6 +1,7 @@ name: "CodeQL" on: + workflow_dispatch: push: branches: [ "master" ] pull_request: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index e4c0ac79..181233e0 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -20,6 +20,7 @@ on: permissions: contents: write pull-requests: write + actions: write jobs: auto_merge: @@ -56,7 +57,7 @@ jobs: return; } - await github.rest.pulls.merge({ + const { data: merge } = await github.rest.pulls.merge({ owner: context.repo.owner, repo: context.repo.repo, pull_number: pull.number, @@ -64,4 +65,20 @@ jobs: sha: context.payload.workflow_run.head_sha, }); - core.info(`Merged Dependabot PR #${pull.number}.`); + if (!merge.merged) { + core.setFailed(`PR #${pull.number} was not merged: ${merge.message}`); + return; + } + + core.info(`Merged Dependabot PR #${pull.number} at ${merge.sha}.`); + + // GITHUB_TOKEN merges do not trigger push workflows. Dispatch the + // default-branch checks explicitly to refresh coverage and CodeQL. + for (const workflow_id of ["build.yml", "lint.yml", "codeql.yml"]) { + await github.rest.actions.createWorkflowDispatch({ + owner: context.repo.owner, + repo: context.repo.repo, + workflow_id, + ref: pull.base.ref, + }); + } diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 5030a053..8adaa784 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -1,6 +1,7 @@ name: Lint on: + workflow_dispatch: push: branches: [ master ] pull_request: