From f325d8218e111e81d2c6c89e6148a6c1468ec1d2 Mon Sep 17 00:00:00 2001 From: Pete Bacon Darwin Date: Fri, 22 May 2026 10:39:41 +0100 Subject: [PATCH] [ci] Pass --repo to gh pr view in dependabot auto-merge The dependabot-auto-merge workflow runs without actions/checkout (by design, since pull_request_target + checkout of PR code is a known attack vector). That means gh has no git remote to infer the repo from, so 'gh pr view $PR_NUMBER' fails with: failed to run git: fatal: not a git repository set -euo pipefail then aborts the verify step before it can reach the fail() helper, turning every workerd-bump PR into a hard CI failure instead of cleanly skipping auto-merge. Pass --repo "$REPO" explicitly to the two 'gh pr view' calls (matching the convention used in c3-e2e.yml, rerun-remote-tests.yml, and others), and replace the inline ${{ github.repository }} expansion in the gh api URL with $REPO so the step has one source of truth. --- .github/workflows/dependabot-auto-merge.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 157a9afa0d4..fabdeaaa239 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -45,13 +45,16 @@ jobs: if: steps.meta.outputs.dependency-group == 'workerd-and-workers-types' env: PR_NUMBER: ${{ github.event.pull_request.number }} + REPO: ${{ github.repository }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | set -euo pipefail - # Pull commits and changed files via the GitHub API. - commits_json=$(gh pr view "$PR_NUMBER" --json commits) - files_json=$(gh pr view "$PR_NUMBER" --json files) + # Pull commits and changed files via the GitHub API. `--repo` is + # required because this workflow runs without `actions/checkout`, + # so `gh` has no git remote to infer the repo from. + commits_json=$(gh pr view --repo "$REPO" "$PR_NUMBER" --json commits) + files_json=$(gh pr view --repo "$REPO" "$PR_NUMBER" --json files) fail() { echo "verified=false" >> "$GITHUB_OUTPUT" @@ -83,7 +86,7 @@ jobs: # `gh pr view --json commits` doesn't expose signature info, so look # it up via the REST commit endpoint. - first_verified=$(gh api "repos/${{ github.repository }}/commits/$first_oid" --jq '.commit.verification.verified') + first_verified=$(gh api "repos/$REPO/commits/$first_oid" --jq '.commit.verification.verified') if [ "$first_verified" != "true" ]; then fail "first commit (Dependabot) does not have a verified signature" fi