[ci] Pass --repo to gh pr view in dependabot auto-merge workflow#14005
Merged
Conversation
The dependabot-auto-merge workflow runs without actions/checkout (by
design, since pull_request_target + checkout of PR code is a known
attack vector). That means gh has no git remote to infer the repo from,
so 'gh pr view $PR_NUMBER' fails with:
failed to run git: fatal: not a git repository
set -euo pipefail then aborts the verify step before it can reach the
fail() helper, turning every workerd-bump PR into a hard CI failure
instead of cleanly skipping auto-merge.
Pass --repo "$REPO" explicitly to the two 'gh pr view' calls (matching
the convention used in c3-e2e.yml, rerun-remote-tests.yml, and others),
and replace the inline ${{ github.repository }} expansion in the
gh api URL with $REPO so the step has one source of truth.
petebacondarwin
added
the
no-changeset-required
|
workers-devprod
requested review from
a team and
jamesopstad
and removed request for
a team
Contributor
|
Codeowners approval required for this PR:
Show detailed file reviewers |
Contributor
|
LGTM |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
james-elicx
approved these changes
May 22, 2026
workers-devprod
approved these changes
May 22, 2026
Contributor
workers-devprod
left a comment
workers-devprod
left a comment
There was a problem hiding this comment.
Codeowners reviews satisfied
create-cloudflare
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-shared
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-pool-workers
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
commit: |
penalosa
pushed a commit
that referenced
this pull request
May 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
dependabot-auto-mergeworkflow (originally landed in #13852) failed on its first real run against PR #14003 (job log) with:Cause. The verify step calls
gh pr view "$PR_NUMBER" --json commits. When given a bare PR number,ghfigures out the repo by shelling out togit remote -v. This workflow deliberately omitsactions/checkout(per the security comment in the file —pull_request_target+ checkout of PR code is the standard pwn vector), so there's no.gitdirectory andghexits 1.set -euo pipefailthen aborts the script before thefail()helper can run, so the step turns red instead of cleanly skipping auto-merge with a warning annotation.The downstream
gh pr merge "$PR_URL"calls don't hit this because they're passed the full HTML URL.Fix. Pass
--repo "$REPO"explicitly to the twogh pr viewcalls, matching the convention used inc3-e2e.yml,rerun-remote-tests.yml,rerun-codeowners-privileged.yml, andactions/check-remote-tests/action.yml. Replaced the inline${{ github.repository }}expansion in thegh apiURL with$REPOso the verify step has one source of truth.pull_request_target, so it can't be unit-tested. Once this lands, the nextdependabot[bot]workerd-bump PR (daily, ~06:00 UTC) will exercise the fix. We can also force it sooner by triggering asynchronizeevent on build(deps): bump the workerd-and-workers-types group across 1 directory with 2 updates #14003 (e.g.@dependabot rebase) —pull_request_targetworkflows use the workflow file frommain, so the fix will be picked up automatically.