From b479ada14f7bb434684fac6c139a2714f180d217 Mon Sep 17 00:00:00 2001 From: Thomas Date: Fri, 7 Aug 2026 20:05:46 +0200 Subject: [PATCH] ci: auto-approve and auto-merge trusted bot pull requests (#6531) * ci: auto-approve and auto-merge trusted bot pull requests Replace the approve-only automatic-approval workflow with a combined approve + enable-auto-merge workflow that also re-runs on every push, plus a scheduled reconcile job that re-enables auto-merge for prepared bot PRs if GitHub ever disables it. Bot PRs are gated to the known bot actors, same-repo head, and base branch dev. * ci: match bot authors by app slug in reconcile filter gh pr list reports pull request authors of GitHub Apps as app/; adjust the allowlist so the reconcile job actually matches bot PRs. --- .github/workflows/automatic-approval.yml | 35 --------------- .../workflows/bot-auto-merge-reconcile.yml | 40 +++++++++++++++++ .github/workflows/bot-pr-automerge.yml | 44 +++++++++++++++++++ 3 files changed, 84 insertions(+), 35 deletions(-) delete mode 100644 .github/workflows/automatic-approval.yml create mode 100644 .github/workflows/bot-auto-merge-reconcile.yml create mode 100644 .github/workflows/bot-pr-automerge.yml diff --git a/.github/workflows/automatic-approval.yml b/.github/workflows/automatic-approval.yml deleted file mode 100644 index 9e246f838..000000000 --- a/.github/workflows/automatic-approval.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: "[Dependency Updates] Auto Approve" -on: - pull_request: - types: [opened, synchronize] - -permissions: {} - -jobs: - approve-automatic-prs: - runs-on: ubuntu-latest - timeout-minutes: 2 - # 158783068: homarr-renovate[bot] - # 190541745: homarr-crowdin[bot] - # 210161987: homarr-update-contributors[bot] - # 175486441: homarr-releases[bot] - # Extracted from https://api.github.com/users/ - if: github.actor_id == 158783068 || github.actor_id == 190541745 || github.actor_id == 210161987 || github.actor_id == 175486441 - steps: - - name: Checkout code - uses: actions/checkout@v7 - - name: Obtain token - id: obtainToken - uses: actions/create-github-app-token@v3 - with: - private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }} - client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }} - permission-pull-requests: write # required to approve pull request - - - name: Install GitHub CLI - run: sudo apt-get install -y gh - - name: Approve automatic PRs - env: - GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }} - run: | - gh pr review ${{github.event.pull_request.number}} --approve --body "Automatically approved by GitHub Action" diff --git a/.github/workflows/bot-auto-merge-reconcile.yml b/.github/workflows/bot-auto-merge-reconcile.yml new file mode 100644 index 000000000..3bc45c127 --- /dev/null +++ b/.github/workflows/bot-auto-merge-reconcile.yml @@ -0,0 +1,40 @@ +name: "[Bots] Reconcile Auto-merge" + +on: + schedule: + - cron: "*/30 * * * *" + workflow_dispatch: + +permissions: {} + +jobs: + reconcile: + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - name: Obtain token + id: obtainToken + uses: actions/create-github-app-token@v3 + with: + private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }} + client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }} + permission-pull-requests: write # required to enable auto-merge + + - name: Install GitHub CLI + run: sudo apt-get install -y gh + + - name: Re-enable auto-merge for prepared bot PRs + env: + GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }} + run: | + # 158783068: homarr-renovate[bot] + # 190541745: homarr-crowdin[bot] + # 210161987: homarr-update-contributors[bot] + # 175441: homarr-releases[bot] + gh pr list --repo "${{ github.repository }}" --base dev --state open --limit 100 \ + --json number,author,reviewDecision,mergeStateStatus,autoMergeRequest \ + --jq '.[] | select(.author.login as $login | ["app/homarr-renovate", "app/homarr-crowdin", "app/homarr-update-contributors", "app/homarr-releases"] | index($login)) | select(.reviewDecision == "APPROVED") | select(.mergeStateStatus == "CLEAN") | select(.autoMergeRequest == null) | .number' \ + | while read -r pr; do + echo "Re-enabling auto-merge on PR #$pr" + gh pr merge "$pr" --auto --squash --delete-branch + done diff --git a/.github/workflows/bot-pr-automerge.yml b/.github/workflows/bot-pr-automerge.yml new file mode 100644 index 000000000..62e604443 --- /dev/null +++ b/.github/workflows/bot-pr-automerge.yml @@ -0,0 +1,44 @@ +name: "[Bots] Approve and Auto-merge" + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + +permissions: {} + +jobs: + approve-and-automerge: + runs-on: ubuntu-latest + timeout-minutes: 5 + # 158783068: homarr-renovate[bot] + # 190541745: homarr-crowdin[bot] + # 210161987: homarr-update-contributors[bot] + # 175441: homarr-releases[bot] + # Extracted from https://api.github.com/users/ + if: | + (github.actor_id == 158783068 || github.actor_id == 190541745 || github.actor_id == 210161987 || github.actor_id == 175441) && + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.base.ref == 'dev' + steps: + - name: Obtain token + id: obtainToken + uses: actions/create-github-app-token@v3 + with: + private-key: ${{ secrets.RENOVATE_APPROVE_PRIVATE_KEY }} + client-id: ${{ secrets.RENOVATE_APPROVE_APP_ID }} + permission-pull-requests: write # required to approve a pull request and enable auto-merge + + - name: Install GitHub CLI + run: sudo apt-get install -y gh + + - name: Approve and enable auto-merge + env: + GITHUB_TOKEN: ${{ steps.obtainToken.outputs.token }} + run: | + PR_NUMBER="${{ github.event.pull_request.number }}" + if [ "$(gh pr view "$PR_NUMBER" --json reviewDecision --jq .reviewDecision)" != "APPROVED" ]; then + gh pr review "$PR_NUMBER" --approve --body "Automatically approved by Homarr bot policy" + fi + if [ "$(gh pr view "$PR_NUMBER" --json autoMergeRequest --jq '.autoMergeRequest != null')" != "true" ]; then + gh pr merge "$PR_NUMBER" --auto --squash + fi