fix(auto-merge-release): use --admin to bypass base branch policy on merge - #89
Merged
Merged
Conversation
…merge The final `gh pr merge` step fails with "the base branch policy prohibits the merge" even after all other checks pass — the App token isn't actually treated as a bypass actor on the caller repo's branch ruleset (observed live on nullplatform/tofu-modules PR #476, required-review rule). Add --admin so the merge goes through if the App's installation has Administration permission; if it doesn't, this fails with a clearer permission-specific error instead of the generic policy one. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
sebastiancorrea81
added a commit
to nullplatform/tofu-modules
that referenced
this pull request
Aug 7, 2026
Small, low-risk change used as a real trigger to test the full post-merge automation chain (#479, #481, nullplatform/actions-nullplatform#89) end-to-end on a clean cycle: this PR's merge → release-please PR → auto-merge (workflow_run + REST author check + --admin) → tag/release, with no manual step in between. Root README's usage example pinned `infrastructure/aws/vpc` to `v1.56.1`, several major versions behind the current `v6.10.0` — updated so copy-pasting the example doesn't point at a stale tag. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Live-tested against nullplatform/tofu-modules PR #476 (a real release-please PR):
find-prresolved it, checks were confirmed green, but the finalgh pr mergefailed with:The App token isn't actually being treated as a bypass actor on the caller repo's branch ruleset (tofu-modules'
mainruleset requires 1 approving review). Every release PR merged historically was done by a human — this may have always been broken, just never reached because of an earlier trigger bug (see nullplatform/tofu-modules#479, #481).Fix
Add
--adminto the merge command. This only succeeds if the App's installation has "Administration: write" permission on the target repo — if it doesn't, the merge will fail with a clearer, permission-specific error instead of the generic policy one, which tells us definitively what to fix next (grant that permission) rather than leaving us guessing.Test plan
auto-merge-release-prrun on nullplatform/tofu-modules (or wait for the next one) and confirm the merge step either succeeds, or fails with a specific permission error we can act on.🤖 Generated with Claude Code