style: automated autofixes from CodeQL workflow #977
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto Merge | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: auto-merge-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| env: | |
| AUTO_MERGE_LABEL: auto-merge | |
| HARDEN_RUNNER_SHA: 0634a2670c59f64b4a01f0f96f84700a4088b9f0 | |
| jobs: | |
| enable: | |
| name: Enable Auto-Merge | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| pull-requests: write | |
| issues: write | |
| contents: read | |
| if: >- | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| ( | |
| (github.event.action == 'labeled' && github.event.label.name == 'auto-merge') || | |
| (github.event.action != 'unlabeled' && contains(github.event.pull_request.labels.*.name, 'auto-merge')) | |
| ) | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| - name: Check if auto-merge already enabled | |
| id: state | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| set -euo pipefail | |
| enabled="$(gh pr view "$PR_NUMBER" --json autoMergeRequest --jq '.autoMergeRequest != null')" | |
| echo "enabled=$enabled" >> "$GITHUB_OUTPUT" | |
| - name: Enable auto-merge (squash) | |
| if: steps.state.outputs.enabled != 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| set -euo pipefail | |
| gh pr merge --auto --squash "$PR_NUMBER" | |
| echo "✅ Auto-merge enabled for PR #$PR_NUMBER" | |
| disable: | |
| name: Disable Auto-Merge | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| pull-requests: write | |
| issues: write | |
| contents: read | |
| if: >- | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| github.event.action == 'unlabeled' && | |
| github.event.label.name == 'auto-merge' | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 | |
| with: | |
| egress-policy: audit | |
| disable-sudo: true | |
| - name: Disable auto-merge (no-op safe) | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| set -euo pipefail | |
| gh pr merge --disable-auto "$PR_NUMBER" || echo "Auto-merge was already disabled." |