Skip to content

feat(workflows): reusable auto-arm-merge workflow #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chitcommit wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat(workflows): reusable auto-arm-merge workflow #7

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b9defb7
feat(workflows): add reusable auto-arm-merge workflow
chitcommit Jun 4, 2026
f91edb5
fix(auto-arm-merge): drop contents:write, classify gh errors, harden …
chitcommit Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
111 changes: 111 additions & 0 deletions .github/workflows/auto-arm-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,111 @@
# Auto-Arm Auto-Merge — Reusable Workflow
# Arms `gh pr merge --auto --squash --delete-branch` on every non-draft PR.
# Usage from a consuming repo (.github/workflows/auto-arm-merge.yml):
#
# name: Auto-Arm Merge
# on:
# pull_request:
# types: [opened, ready_for_review, reopened]
# jobs:
# arm:
# uses: chittyfoundation/.github/.github/workflows/auto-arm-merge.yml@main
#
# Skip conditions (PR is left alone):
# - draft PRs
# - authors: dependabot[bot], renovate[bot] (they have their own auto-merge logic)
# - title starts with: WIP, [WIP], Draft:, DO NOT MERGE (enforced inside the step
# via regex; GitHub Actions expressions lack regex, and startsWith('WIP') would
# false-match WIPER/WIPE)
# - Fork PRs are skipped at the trigger level (GITHUB_TOKEN is read-only on the
# head ref of a fork, so the gh call would never succeed anyway)
#
Comment on lines +5 to +21

@coderabbitai coderabbitai Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

When a reusable workflow is called from a pull_requestworkflow, does subscribing the caller to theedited activity type trigger the called workflow again with the updated PR title?

💡 Result:

Yes, subscribing the caller workflow to the pull_request activity type edited will trigger the called (reusable) workflow again when a pull request title is updated [1][2][3]. When you define a reusable workflow, it is executed by a caller workflow [4]. If the caller workflow is configured to trigger on the pull_request event with the edited activity type, GitHub Actions will initiate a new workflow run whenever that activity occurs [5][6][7]. Because the reusable workflow is called within a job in that caller workflow, the reusable workflow will also be invoked as part of that new run [4][1]. Key details to keep in mind: 1. Configuration: By default, the pull_request event only triggers on opened, synchronize, and reopened activity types [5][6][8]. To capture title or body changes, you must explicitly include edited in your types configuration: on: pull_request: types: [opened, synchronize, edited] 2. Workflow Behavior: Every time the event occurs, a new workflow run is created [6][7]. If your reusable workflow performs actions (like commenting on the PR or deploying), it will execute these actions again [1]. 3. Common Issue: Users often find that enabling the edited activity type causes unnecessary workflow runs [2]. If you only want to trigger the workflow for specific types of edits (e.g., only when the title changes, rather than the body), you will need to add conditional logic (if statements) within your jobs to check the event context and decide whether to proceed or skip execution [9][2][10].

Citations:

🏁 Script executed:

#!/bin/bash
set -euo pipefail

ls -la .github/workflows || true
sed -n '1,120p' .github/workflows/auto-arm-merge.yml

Repository: chittyfoundation/.github

Length of output: 3400

Add edited to the caller pull_request types if the WIP/title opt-out should be reversible.

The reusable workflow’s if: skips based on the current PR title; since the consuming example only triggers on opened, ready_for_review, and reopened, removing a WIP/Draft prefix via title edit won’t re-invoke the workflow.

Suggested change 
 #   on:
 #     pull_request:
-#       types: [opened, ready_for_review, reopened]
+#       types: [opened, edited, ready_for_review, reopened]
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/auto-arm-merge.yml around lines 5 - 18, Update the
pull_request trigger types in the consuming workflow so title edits re-run the
reusable workflow: add "edited" to the types list alongside "opened",
"ready_for_review", and "reopened" in the workflow header (the section that
currently lists pull_request types) so the Auto-Arm Merge logic will re-evaluate
when a PR title is changed (e.g., removing a WIP/Draft prefix).

# Repos consuming this MUST have:
# - Settings -> General -> "Allow auto-merge" enabled
# - Settings -> General -> "Automatically delete head branches" enabled
# - A branch ruleset that gates merge on required checks (otherwise auto-merge
# would fire instantly with no protection)

name: Auto-Arm Merge (reusable)

on:
workflow_call:
inputs:
merge-method:
description: 'Merge method: squash | merge | rebase'
required: false
type: string
default: squash
Comment thread
coderabbitai[bot] marked this conversation as resolved.

# Least privilege: arming auto-merge only mutates the PR object. We do NOT need
# contents:write — a compromised step with contents:write could push to the
# default branch.
permissions:
pull-requests: write

jobs:
arm:
name: Arm auto-merge
runs-on: ubuntu-latest
# Collapse duplicate runs from rapid opened+ready_for_review sequences on the
# same PR. Cancel any in-flight arming for the same PR before starting a new one.
concurrency:
group: auto-arm-${{ github.repository }}-${{ github.event.pull_request.number }}
cancel-in-progress: true
if: >-
github.event.pull_request.draft == false &&
github.event.pull_request.user.login != 'dependabot[bot]' &&
github.event.pull_request.user.login != 'renovate[bot]' &&
github.event.pull_request.head.repo.full_name == github.repository
steps:
- name: Enable auto-merge
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
REPO: ${{ github.repository }}
METHOD: ${{ inputs.merge-method }}
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
set -euo pipefail

# Preflight: gh must be present on the runner.
command -v gh >/dev/null || { echo "::error::gh CLI missing on runner"; exit 1; }

# Validate merge-method to prevent injecting arbitrary flags via the
# workflow_call input.
case "$METHOD" in
squash|merge|rebase) ;;
*) echo "::error::invalid merge-method '$METHOD' (must be squash/merge/rebase)"; exit 1 ;;
esac

# Title-prefix guard (regex-based; YAML expressions can't do regex, so
# this lives here). The boundary class [[:space:]:/-] (or end-of-string)
# ensures WIPER / WIPE / WIPED do NOT match, while accepting:
# "WIP fix", "WIP: fix", "[WIP] fix", "Draft: fix", "DO NOT MERGE - x"
if [[ "$PR_TITLE" =~ ^(WIP|\[WIP\]|Draft:|DO[[:space:]]NOT[[:space:]]MERGE)([[:space:]:/-]|$) ]]; then
echo "::notice::skipped — title prefix signals not-ready: $PR_TITLE"
exit 0
fi

echo "Arming auto-merge on ${REPO}#${PR_NUMBER} (method=${METHOD})"
# --delete-branch is honored by GitHub at merge time when the repo
# has "Automatically delete head branches" enabled.
set +e
err=$(gh pr merge --auto "--${METHOD}" --delete-branch --repo "${REPO}" "${PR_NUMBER}" 2>&1)
rc=$?
set -e
if [ "$rc" -eq 0 ]; then
echo "::notice::auto-merge armed for ${REPO}#${PR_NUMBER} (${METHOD})"
exit 0
fi
case "$err" in
*"Pull request is not mergeable"*|*"already"*|*"closed"*)
echo "::notice::benign skip (${REPO}#${PR_NUMBER}): $err"; exit 0 ;;
*"auto merge is not allowed"*|*"not enabled"*)
echo "::error::repo missing allow_auto_merge=true on ${REPO}"; exit 1 ;;
*"not allowed to merge"*|*"merge method"*)
echo "::error::merge-method '${METHOD}' not permitted on ${REPO} (ruleset/setting): $err"; exit 1 ;;
*"HTTP 401"*|*"HTTP 403"*|*"Bad credentials"*|*"Resource not accessible"*)
echo "::error::token scope/auth (${REPO}): $err"; exit 1 ;;
*)
echo "::error::unexpected gh failure (${REPO}#${PR_NUMBER}, rc=${rc}): $err"; exit 1 ;;
esac
Loading