Auto-enable PR auto-merge in weekly-audit workflow#52
Merged
Conversation
The weekly-audit workflow opens a PR when a CVE delta is detected, but prior to this change the maintainer had to manually click "Merge" or "Enable auto-merge" for every audit PR. Add a follow-up step that calls `gh pr merge --auto --squash` against the PR just created/updated, so the GitHub auto-merge daemon picks it up the moment hermes' approval and required checks are in. Maintainer involvement is now only required when hermes flags a regression. Gated on `pull-request-operation` being created/updated to avoid firing on no-op runs.
Contributor
Trivy misconfiguration findings (HIGH + CRITICAL)✅ No HIGH or CRITICAL misconfigurations detected. |
wn-hermes
approved these changes
May 25, 2026
wn-hermes
left a comment
wn-hermes
left a comment
Collaborator
There was a problem hiding this comment.
Workflow change review
Files changed: .github/workflows/weekly-audit.yml only.
What this does
Adds an id: audit_pr handle to the existing peter-evans/create-pull-request audit PR step, then uses that step's outputs to enable GitHub auto-merge on the created or updated audit PR with gh pr merge --auto --squash --delete-branch.
Verification
- Diff matches description: yes — only the step id and the new auto-merge enablement step were added.
- Any hidden changes: no — only
.github/workflows/weekly-audit.ymlchanged, with 10 added lines and no deletions. - Token/permission/secret implications: no secret values exposed; the new step uses the workflow
GITHUB_TOKENviaGH_TOKEN, and the diff does not alter the existing permissions block.
Verdict
Looks safe as a one-off workflow change; the if: gate correctly limits auto-merge enablement to created or updated audit PRs.
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
id: audit_prto thepeter-evans/create-pull-requeststep inweekly-audit.yml.gh pr merge --auto --squash --delete-branchagainst the newly-created/updated audit PR, so GitHub's auto-merge daemon takes over once hermes' approval and required checks land.pull-request-operation == 'created' || 'updated'so no-op runs don't trigger.Why
Today's PR #51 required manual "Enable auto-merge" clicks (after the enterprise/org/repo permission cascade was sorted). With this change, the weekly audit is end-to-end hands-off: cron → scan → delta → PR → hermes review → auto-merge. Maintainer involvement remains for the case where hermes flags a regression (it posts a
--commentreview then, which doesn't satisfy the count gate, so auto-merge stays paused for human eyes).Risk
Low. If anything goes wrong with auto-merge enablement, the PR stays open and the maintainer can merge by hand — same as the pre-change behaviour. No effect on the scan/delta logic itself.
Test plan
actionlint+yamllintpass against the modified file.