0

Trying to automate merges of dependabot PR´s in Github and wrote the workflow as in this guide, https://github.com/marketplace/actions/dependabot-auto-merge except for the token name.

As token i have created a personal access token and then added the token as a secret named MY_SECRET in the repository.

This is my workflow template:

name: Dependabot auto-approve
on: pull_request

permissions:
  pull-requests: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v1
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Approve a PR
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
  auto-merge:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: ahmadnassri/action-dependabot-auto-merge@v2
        with:
          target: minor
          github-token: ${{ secrets.MY_TOKEN }}

And the auto-merge job fails. When I use ${{ secrets.MY_TOKEN }}, or leave an empty string, then I get the error:

throw new Error(`Input required and not supplied: ${name}`);

If I replace the ${{ secrets.MY_TOKEN }} with any random string value, then I get invalid credentials response.

Based on this my conclusion is that the secret is not provided. I just cannot figure out why.

I read some issues with having reusable workflows, but I am not sure if this count as one.

Anders Breid
  • 121
  • 1
  • 8
  • So you created a secret called `MY_SECRET` in the repository and you refer to that as `MY_TOKEN` ? that's wrong you have to use `${{ secrets.MY_SECRET }}` – Fcmam5 Aug 23 '23 at 10:25
  • MY_SECRET was a typo, it should have been MY_TOKEN, but found out why I could not use it and will write a response. – Anders Breid Aug 23 '23 at 18:16

1 Answers1

0

After continuing the investigation I found out that repository secrets under the Actions tab is not accessable during pull request pipeline executions.

There is a specific tab for dependabot pipelines that can store secrets encrypted as well. This is only accessable by dependabot pull request pipelines.

Anders Breid
  • 121
  • 1
  • 8