From 35a833c646bc43fab1a35d2da571f62f869cb4df Mon Sep 17 00:00:00 2001 From: codemastervy Date: Sun, 30 Aug 2026 20:09:07 +1200 Subject: [PATCH] Fix: bimonthly PRs never had CI run against them Pushes made with the workflow's own GITHUB_TOKEN don't trigger other workflows (a GitHub Actions loop-prevention rule), so ci.yml's normal pull_request/push triggers never fired for the PR this workflow opens. gh pr merge --auto was waiting on required checks that could never appear. Found by actually running the workflow end to end and watching the resulting PR sit with mergeStateStatus BLOCKED and zero checks. Fixed by explicitly running `gh workflow run ci.yml --ref $BRANCH` right after pushing -- the resulting check-runs attach to the commit SHA, which is what branch protection actually matches on, regardless of which event triggered the run. --- .github/workflows/bimonthly-dependency-update.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/workflows/bimonthly-dependency-update.yml b/.github/workflows/bimonthly-dependency-update.yml index 7fc74b1..20ade4d 100644 --- a/.github/workflows/bimonthly-dependency-update.yml +++ b/.github/workflows/bimonthly-dependency-update.yml @@ -82,6 +82,9 @@ jobs: permissions: contents: write pull-requests: write + # Needed to explicitly kick off ci.yml below -- see the comment there + # for why that's necessary at all. + actions: write steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 @@ -125,6 +128,17 @@ jobs: git commit -m "Bimonthly dependency update ($(date +%Y-%m-%d))" git push -u origin "$BRANCH" + # Pushes made with the workflow's own GITHUB_TOKEN do NOT trigger + # other workflows -- this is a deliberate GitHub Actions + # loop-prevention rule, not a bug, but it means ci.yml's normal + # `pull_request`/`push` triggers will never fire for this branch, + # so the required status checks it provides would never appear and + # `gh pr merge --auto` below would wait forever. Triggering ci.yml + # explicitly registers real check-runs against this exact commit, + # which is what branch protection actually looks at -- matched by + # commit SHA and check name, not by which event caused the run. + gh workflow run ci.yml --ref "$BRANCH" + BODY=$'Approved via the `dependency-approval` environment on '"$(date +%Y-%m-%d)"$'.\n\nThis still has to pass backend-tests, frontend-build and docker-build --\nrequired by branch protection on `main` -- before it can merge. If any of\nthose fail, this PR stays open, unmerged, for you to look at.' PR_URL=$(gh pr create --title "Bimonthly dependency update ($(date +%Y-%m-%d))" --body "$BODY")