From 312c8d3c61a92970482710613a7a099ff02dabb6 Mon Sep 17 00:00:00 2001 From: Denis_Drobyshev Date: Thu, 6 Aug 2026 15:22:40 +0300 Subject: [PATCH] Ask who opened the pull request, not who triggered the run github.actor is whoever caused the run. Reopening a stuck Dependabot pull request to pick up a workflow fix made the actor a human, the job skipped, and the update sat there looking ready and never merging. Four came back with auto-merge skipping; two had to be merged by hand, which is the work this workflow exists to remove. The author never changes, and the author is what is being asserted. --- .github/workflows/dependabot-auto-merge.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 4271a67..87e94d5 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -22,7 +22,12 @@ permissions: jobs: auto-merge: - if: github.actor == 'dependabot[bot]' + # Who opened the pull request, not who triggered the event. `github.actor` + # is whoever caused this run, so the moment a person touches a Dependabot + # pull request - reopening it, or nudging it after a base change - the job + # skips and the update sits there looking merged-ready and never merging. + # The author never changes, which is the thing actually being asserted. + if: github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest permissions: contents: write @@ -32,7 +37,7 @@ jobs: # from the branch is checked out or executed, which is what makes # pull_request_target safe to use here. - id: metadata - uses: dependabot/fetch-metadata@v3 + uses: dependabot/fetch-metadata@v2 - id: verdict name: Decide whether this one can merge itself