From fbbdd39caa41370824f2f135a867b09f3b4d6d64 Mon Sep 17 00:00:00 2001 From: DanFashauer Date: Mon, 1 Jun 2026 20:11:26 -0400 Subject: [PATCH] Archive noisy auto-merge workflows --- .github/workflows-disabled/README.md | 8 ++++++++ .../{workflows => workflows-disabled}/auto-approve.yml | 0 .github/{workflows => workflows-disabled}/auto-merge.yml | 0 docs/REPO_ENV_AUDIT_2026-03-31.md | 5 +++-- 4 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 .github/workflows-disabled/README.md rename .github/{workflows => workflows-disabled}/auto-approve.yml (100%) rename .github/{workflows => workflows-disabled}/auto-merge.yml (100%) diff --git a/.github/workflows-disabled/README.md b/.github/workflows-disabled/README.md new file mode 100644 index 0000000..340a484 --- /dev/null +++ b/.github/workflows-disabled/README.md @@ -0,0 +1,8 @@ +# Archived automation workflows + +The workflows in this directory are intentionally archived during the controlled-demo and manual-review phase. +They are preserved for future reference, but they are not active GitHub Actions workflows while they remain outside `.github/workflows/`. + +Do not restore these workflows until the repository's branch protection, required labels, GitHub App permissions, and merge policy have been reviewed together. + +If an archived workflow is restored, it must use a valid `pull_request` context or explicit `workflow_dispatch` inputs, such as `pr_number`, before it attempts to approve, merge, or otherwise act on a pull request. diff --git a/.github/workflows/auto-approve.yml b/.github/workflows-disabled/auto-approve.yml similarity index 100% rename from .github/workflows/auto-approve.yml rename to .github/workflows-disabled/auto-approve.yml diff --git a/.github/workflows/auto-merge.yml b/.github/workflows-disabled/auto-merge.yml similarity index 100% rename from .github/workflows/auto-merge.yml rename to .github/workflows-disabled/auto-merge.yml diff --git a/docs/REPO_ENV_AUDIT_2026-03-31.md b/docs/REPO_ENV_AUDIT_2026-03-31.md index b7d25a4..ec92397 100644 --- a/docs/REPO_ENV_AUDIT_2026-03-31.md +++ b/docs/REPO_ENV_AUDIT_2026-03-31.md @@ -65,8 +65,9 @@ This audit covers: ### 4) Workflow automation has broad write-level behavior that should be revalidated (P1) **What was observed** -- Auto-merge workflow has top-level `contents: write` and `pull-requests: write` permissions. -- Auto-approve flow can auto-approve and auto-merge labeled PRs after checks. +- Auto-approve and auto-merge automation workflows are archived under `.github/workflows-disabled/` during the controlled-demo/manual-review phase; they are not active workflows. +- The archived workflows must not be restored until branch protection, required labels, GitHub App permissions, and merge policy are reviewed together. +- If restored, the workflows must use a valid `pull_request` context or explicit `workflow_dispatch` inputs such as `pr_number` before approving or merging pull requests. **Why this matters** - Automation blast radius is higher when write permissions are broad.