Repository navigation
ci: auto-merge a bot-opened PR once a person labels it automerge - #37
Merged
Merged
Conversation
A labeled pull request authored by the Containarium bot gets GitHub's squash auto-merge enabled; GitHub merges it once the required status checks pass. A pull request that touches .github/ is refused. The workflow runs from the base branch (pull_request_target) and checks out no PR code. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lets a person approve a bot-opened pull request for automatic merge with one label.
What it does
When the label
automergeis added to a pull request authored bycontainarium-ci[bot], this workflow runsgh pr merge --auto --squashon it. GitHub then merges the PR as soon as the branch's required status checks pass (todaygo,proto,web). The workflow never merges anything itself.Guards
automergelabel starts it, so each merge stays a deliberate human act (one click), and the label can be removed or the auto-merge cancelled before checks finish.containarium-ci[bot]..github/is refused (exit 1); a person merges those, because a workflow can read secrets and run with the repository token.pull_request_target, so the workflow definition comes frommain, and it checks out no PR code.contents: writeandpull-requests: writeonly, which GitHub requires to enable auto-merge.Known limitation
A merge that GitHub performs for auto-merge enabled with the workflow's
GITHUB_TOKENdoes not triggerpushworkflows onmain(GitHub does not start workflows from events caused by that token). The checks already ran on the pull request, but thecirun on the merge commit will not start by itself. If that matters, use a token from a GitHub App or a PAT forGH_TOKEN.Not changed here
Branch protection is unchanged. Making
e2ea required check is a separate step after the e2e workflow (#35) is onmain, and needs that workflow'spathsfilter removed first: a required check that a path filter skips leaves a PR stuck waiting for it.🤖 Generated with Claude Code