Stop this repository merging itself on a green lint - #8
Merged
Conversation
Every other repository's changes reach that repository. These reach all sixteen, at @main, with secrets: inherit. The caller here merged its own pull requests once lint went green, and it had been doing so for the change that replaced the merge credential itself — a workflow edit that landed with nobody reading it. Authorship was never the boundary. A Dependabot action-SHA bump edits the shared workflows exactly as an owner change does, so restricting the allowlist would have moved the problem rather than closed it. The caller goes instead, and merging here becomes a deliberate click after lint passes. That is the gate document 08 described before it was corrected to match what the token happened to allow. A required review cannot do this job. GitHub will not accept a self-approval, so on a single-maintainer repository requiring one blocks every merge rather than gating it. The README was also describing the estate before the migration: the shared workflow examples still told a reader to write uses: damian1000/.github, and auto-merge was still documented as holding AUTOMERGE_TOKEN rather than minting a token per run from the organisation's app. The allowlist's damian1000 stays — that is the account login, which the organisation move kept.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every other repository's changes reach that repository. These reach all sixteen, at
@main, withsecrets: inherit. The caller here merged this repository's own pullrequests as soon as lint went green — including #4, the change that replaced the
merge credential itself, which landed with nobody reading it.
Authorship was never the boundary. A Dependabot action-SHA bump edits the shared
workflows exactly as an owner change does, so narrowing the allowlist would have
moved the problem rather than closed it. The caller goes instead, and merging here
becomes a deliberate click after lint passes — the gate
docs/08-github-standards.mddescribed before it was corrected to match what the token happened to allow.
A required review cannot do this job: GitHub will not accept a self-approval, so
requiring one on a single-maintainer repository blocks every merge rather than
gating it.
automerge.ymlitself is unchanged apart from a comment recording why thisrepository is the exception — it is the file someone reads before adding a caller
elsewhere. The other fifteen repositories keep auto-merge exactly as they had it.
Also corrects the README where the migration left it wrong: the shared workflow
examples still told a reader to write
uses: damian1000/.github/..., and auto-mergewas still documented as holding
AUTOMERGE_TOKENrather than minting a token per runfrom the organisation's app. The allowlist's
damian1000stays — that is the accountlogin, which the organisation move kept.