From 6533a85406ccf0df932eaf1da54c292df49ce866 Mon Sep 17 00:00:00 2001 From: Xavier Roche Date: Tue, 1 Sep 2026 15:44:08 +0200 Subject: [PATCH 1/3] Stop ranking the two clauses of the auto-merge guard Calling the head-repo clause the one that cannot be forged implies the author clause can be. GitHub logins hold only letters, digits and hyphens, so dependabot[bot] is unregisterable and user.login is immutable for a PR's life. The clauses are complementary: the author one excludes other authors, the head-repo one excludes forks. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Xavier Roche --- .github/workflows/dependabot-automerge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index db82d14..750c040 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -22,7 +22,7 @@ jobs: automerge: name: Arm auto-merge # github.actor is the pusher, not the author, so a dependabot push onto a fork PR can - # satisfy it. The head-repo clause is the one that cannot be forged. + # satisfy it. Dependabot never opens a PR from a fork. if: >- github.repository == 'xroche/httrack-android' && github.event.pull_request.user.login == 'dependabot[bot]' From 37ca68dfbf17829dfbdacc4cdfb152d5d4827737 Mon Sep 17 00:00:00 2001 From: Xavier Roche Date: Tue, 1 Sep 2026 15:50:48 +0200 Subject: [PATCH 2/3] Say what the head-repo clause is for, not that it cannot fire "Dependabot never opens a PR from a fork" is true, but it argues the clause can never fire, which invites deleting it. The clause is defence in depth: it holds if the author check is ever loosened. GitHub's own recommended guard omits it, so the reason has to be on the line. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Xavier Roche --- .github/workflows/dependabot-automerge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 750c040..90a187e 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -22,7 +22,7 @@ jobs: automerge: name: Arm auto-merge # github.actor is the pusher, not the author, so a dependabot push onto a fork PR can - # satisfy it. Dependabot never opens a PR from a fork. + # satisfy it. The head-repo clause still holds if the author check is ever loosened. if: >- github.repository == 'xroche/httrack-android' && github.event.pull_request.user.login == 'dependabot[bot]' From 9c636538a937781fe75250890b8536ec920a4b0d Mon Sep 17 00:00:00 2001 From: Xavier Roche Date: Tue, 1 Sep 2026 15:52:46 +0200 Subject: [PATCH 3/3] Give each clause of the auto-merge guard its own reason The first sentence was false for the default event set: github.actor names whoever triggered the event, and on opened that is the author. The second justified the head-repo clause by a future edit, which argues it does nothing today. Both now state a present-tense reason. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Xavier Roche --- .github/workflows/dependabot-automerge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 90a187e..7fd663a 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -21,8 +21,8 @@ permissions: jobs: automerge: name: Arm auto-merge - # github.actor is the pusher, not the author, so a dependabot push onto a fork PR can - # satisfy it. The head-repo clause still holds if the author check is ever loosened. + # github.actor names whoever triggered the event, so the author check reads user.login. + # The head-repo clause makes dependabot's same-repo branches a precondition, not an assumption. if: >- github.repository == 'xroche/httrack-android' && github.event.pull_request.user.login == 'dependabot[bot]'