ci(auto-merge): consume reusable workflow from renovate-config#103
Conversation
Replaces the local 154-line auto-merge workflow with a 23-line thin caller that delegates to ANcpLua/renovate-config/.github/workflows/ auto-merge-reusable.yml@main. The reusable workflow uses a GitHub App installation token instead of GITHUB_TOKEN, fixing the cascade-block bug: native auto-merge under GITHUB_TOKEN identity silently drops the resulting push: main event, preventing downstream publish workflows from triggering. Required secrets in this repo: AUTOMERGE_APP_ID AUTOMERGE_APP_PRIVATE_KEY See https://github.com/ANcpLua/renovate-config#auto-merge-reusable-workflow Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe pull request consolidates GitHub Actions workflow automation across two files. In 🚥 Pre-merge checks | ✅ 8✅ Passed checks (8 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
|
@coderabbitai autofix |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
Larger PRs occasionally need base-branch context beyond the last 20 commits. Costs ~2-3s extra checkout time. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
@coderabbitai autofix |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
|
@coderabbitai autofix |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 23aea091e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| run: gh pr merge --auto --squash "$PR_URL" | ||
| auto-merge: | ||
| uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
Using secrets: inherit forwards every secret available to this workflow (repository, organization, and environment secrets) to the called workflow job, not just the two auto-merge app secrets. Because this job calls a workflow in another repository, any change there can access unrelated secrets and turn this into a broad credential-exposure path; pass only the required secret names explicitly instead.
Useful? React with 👍 / 👎.
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: gh pr merge --auto --squash "$PR_URL" | ||
| auto-merge: | ||
| uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main |
There was a problem hiding this comment.
Referencing the reusable workflow as @main makes this repository execute whatever happens to be on that branch at runtime, so upstream pushes can silently change merge behavior or break this repo without any local diff. Since the called workflow runs with write permissions and inherited secrets, this is also a security hardening gap; pin to a full commit SHA (or controlled release tag) for deterministic behavior.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-merge.yml:
- Line 23: Replace the broad "secrets: inherit" usage with an explicit secrets
mapping that only passes the documented secrets; remove "secrets: inherit" and
add explicit keys for AUTOMERGE_APP_ID and AUTOMERGE_APP_PRIVATE_KEY (mapping
each to their corresponding repository secret, e.g. set AUTOMERGE_APP_ID to the
repository secret AUTOMERGE_APP_ID and AUTOMERGE_APP_PRIVATE_KEY to the
repository secret AUTOMERGE_APP_PRIVATE_KEY) so the reusable workflow only
receives those two secrets.
- Line 22: Replace the mutable branch reference in the reusable workflow call
with a specific commit SHA: change the uses value
"ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main" to the
same path but pinned to the exact commit SHA you reviewed (e.g.,
"ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<commit-sha>");
update the single uses line in .github/workflows/auto-merge.yml so the reusable
workflow is referenced by that immutable commit hash.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: c22d55b0-18da-462d-8d54-84bc705502a7
📒 Files selected for processing (2)
.github/workflows/auto-merge.yml.github/workflows/claude-code-review.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 180000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: claude-review
🧰 Additional context used
📓 Path-based instructions (1)
.github/workflows/**
⚙️ CodeRabbit configuration file
.github/workflows/**: Pin third-party actions to SHA. First-party (actions/*) tag-pin OK.
Concurrency groups required on push-triggered workflows.
Secrets via env: not inline. No secrets in logs.
Minimal permissions per job.
Pattern A release: changes to compute_version logic affect every push to
main — flag carefully.
Files:
.github/workflows/claude-code-review.yml.github/workflows/auto-merge.yml
🔇 Additional comments (1)
.github/workflows/claude-code-review.yml (1)
35-35: LGTM. More history, better context.Expanding shallow clone depth from 20 to 100 commits is sensible for agentic review. No structural concerns.
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: gh pr merge --auto --squash "$PR_URL" | ||
| auto-merge: | ||
| uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "auto-merge.yml" -o -name "auto-merge*.yml" | head -20Repository: ANcpLua/ANcpLua.NET.Sdk
Length of output: 102
🏁 Script executed:
cat -n .github/workflows/auto-merge.yml 2>/dev/null | head -30Repository: ANcpLua/ANcpLua.NET.Sdk
Length of output: 847
Pin the reusable workflow to a commit SHA.
@main makes this privileged caller consume mutable workflow code from another repository. GitHub documents commit SHAs as the safest option for stability and security on reusable workflows. Pin this to the exact commit you reviewed.
Suggested change
- uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main
+ uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<commit-sha>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-merge.yml at line 22, Replace the mutable branch
reference in the reusable workflow call with a specific commit SHA: change the
uses value
"ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main" to the
same path but pinned to the exact commit SHA you reviewed (e.g.,
"ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@<commit-sha>");
update the single uses line in .github/workflows/auto-merge.yml so the reusable
workflow is referenced by that immutable commit hash.
| run: gh pr merge --auto --squash "$PR_URL" | ||
| auto-merge: | ||
| uses: ANcpLua/renovate-config/.github/workflows/auto-merge-reusable.yml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
find . -name "auto-merge.yml" -type fRepository: ANcpLua/ANcpLua.NET.Sdk
Length of output: 102
🏁 Script executed:
cat -n ./.github/workflows/auto-merge.ymlRepository: ANcpLua/ANcpLua.NET.Sdk
Length of output: 847
Replace secrets: inherit with explicit secret mapping.
Line 23 uses secrets: inherit, passing all caller secrets to the reusable workflow despite the file documenting only two required secrets: AUTOMERGE_APP_ID and AUTOMERGE_APP_PRIVATE_KEY. This unnecessarily widens the blast radius and violates the principle of minimal permissions per job.
Fix
- secrets: inherit
+ secrets:
+ AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }}
+ AUTOMERGE_APP_PRIVATE_KEY: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| secrets: inherit | |
| secrets: | |
| AUTOMERGE_APP_ID: ${{ secrets.AUTOMERGE_APP_ID }} | |
| AUTOMERGE_APP_PRIVATE_KEY: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-merge.yml at line 23, Replace the broad "secrets:
inherit" usage with an explicit secrets mapping that only passes the documented
secrets; remove "secrets: inherit" and add explicit keys for AUTOMERGE_APP_ID
and AUTOMERGE_APP_PRIVATE_KEY (mapping each to their corresponding repository
secret, e.g. set AUTOMERGE_APP_ID to the repository secret AUTOMERGE_APP_ID and
AUTOMERGE_APP_PRIVATE_KEY to the repository secret AUTOMERGE_APP_PRIVATE_KEY) so
the reusable workflow only receives those two secrets.
|
@coderabbitai autofix |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. ⛔ CodeRabbit does not have permission to push changes to this repository. Please ensure CodeRabbit has Contents: Read and write permission. |
ANcpLua
dismissed
coderabbitai[bot]’s stale review
SHA-pin/secrets-explicit concerns are upstream-workflow concerns; consumer thin-callers consume @main per the framework pattern. Resolved similarly on Analyzers#107 and qyl#186.
Summary
Replaces the local auto-merge workflow with a thin caller delegating to the new reusable workflow at ANcpLua/renovate-config (PR #5 there).
Why
When the Owner / AI Agent / CodeRabbit tier calls
gh pr merge --autounderGITHUB_TOKENidentity, GitHub records the eventual native-auto-merge as performed bygithub-actions[bot]. Per GitHub docs, events triggered byGITHUB_TOKEN(other thanworkflow_dispatch/repository_dispatch) do NOT trigger new workflow runs — anti-loop protection. So the resultingpush: mainis silently dropped and downstream publish workflows never fire.Symptom seen on 2026-05-04: ANcpLua.NET.Sdk PR #99 merged at 20:22:30 UTC. The
push: mainevent for the merge commit produced ZERO workflow runs. SDK had to be manually dispatched viagh workflow runto ship v3.4.16.The fix uses a GitHub App installation token. The App becomes the merge actor; events fire normally.
Required setup
This PR is draft until two repo secrets exist:
AUTOMERGE_APP_ID— the numeric App IDAUTOMERGE_APP_PRIVATE_KEY— full PEM contents of the App's private keySetup is a one-time 5-min manual step:
Once the secrets are in place this PR can be marked ready and merged.
Test plan
Summary by CodeRabbit