From b75b358d2205bbb853ad96fed38ed85dde0faf56 Mon Sep 17 00:00:00 2001 From: "i.novik" Date: Sat, 25 Jul 2026 19:25:46 +0200 Subject: [PATCH] ci: gate Dependabot auto-merge on github.actor, not PR author Fixes "PR is not from Dependabot, nothing to do" from dependabot/fetch-metadata. The job gated on the PR author (always dependabot), so it ran even when a human triggered the event (e.g. clicked "Update branch"); fetch-metadata then checks github.actor, sees the human, and aborts with exit 1. Gating the whole job on `github.actor == 'dependabot[bot]'` (GitHub's documented pattern) means human-triggered events skip cleanly instead of failing. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/dependabot-automerge.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index aa06f8f..5464fd9 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -17,8 +17,12 @@ permissions: jobs: auto-merge: runs-on: ubuntu-latest - # Only act on Dependabot's own PRs. - if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }} + # Only act on events Dependabot itself triggered (opened the PR or rebased + # it). Gating on `github.actor` — not the PR author — matches what + # dependabot/fetch-metadata requires: when a human triggers the event (e.g. + # clicks "Update branch"), github.actor is that human and fetch-metadata + # aborts with "PR is not from Dependabot". Skipping the job avoids that. + if: ${{ github.actor == 'dependabot[bot]' }} steps: - name: Fetch Dependabot metadata id: metadata