Skip to content

dependabot: auto-merge requires on pull_request types - #43017

Closed
clwluvw wants to merge 1 commit into
github:mainfrom
clwluvw:patch-1
Closed

dependabot: auto-merge requires on pull_request types#43017
clwluvw wants to merge 1 commit into
github:mainfrom
clwluvw:patch-1

Conversation

@clwluvw

@clwluvw clwluvw commented Feb 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Why:

Auto-merge appears to function correctly with pull_request with types, allowing it to authenticate and operate within the context of the target repository. Without this, a 401 error is returned due to insufficient scope.

> Run gh pr merge --auto --merge "$PR_URL"
non-200 OK status code: 401 Unauthorized body: "{\r\n  \"message\": \"Bad credentials\",\r\n  \"documentation_url\": \"[https://docs.github.com/rest\](https://docs.github.com/rest/)",\r\n  \"status\": \"401\"\r\n}"

Check off the following:

  • A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
  • The changes in this PR meet the docs fundamentals that are required for all content.
  • All CI checks are passing and the changes look good in the review environment.

Copilot AI review requested due to automatic review settings February 18, 2026 15:41
@github-actions

github-actions Bot commented Feb 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source Review Production What Changed
code-security/tutorials/secure-your-dependencies/automating-dependabot-with-github-actions.md fpt
ghec
ghes@ 3.19 3.18 3.17 3.16 3.15 3.14
fpt
ghec
ghes@ 3.19 3.18 3.17 3.16 3.15 3.14

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

@github-actions github-actions Bot added the triage Do not begin working on this issue until triaged by the team label Feb 18, 2026
Copilot AI reviewed Feb 18, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request proposes changing the trigger event for the Dependabot auto-merge workflow from pull_request to pull_request_target with specific activity types. The PR description claims this change is needed to fix authentication issues (401 errors due to insufficient scope).

Changes:

  • Modified the workflow trigger from on: pull_request to on: pull_request_target with types [opened, reopened, synchronize]

Comment thread ...ode-security/tutorials/secure-your-dependencies/automating-dependabot-with-github-actions.md Outdated
@clwluvw
dependabot: auto-merge requires on pull_request types
0d36ad5 
Auto-merge appears to function correctly with `pull_request` with types,
allowing it to authenticate and operate within the context of the target
repository. Without this, a 401 error is returned due to insufficient scope.

Signed-off-by: Seena Fallah <seenafallah@gmail.com>
@clwluvw clwluvw changed the title dependabot: auto-merge requires on pull_request_target dependabot: auto-merge requires on pull_request types Feb 19, 2026
@Sharra-writes Sharra-writes added content This issue or pull request belongs to the Docs Content team code security Content related to code security and removed triage Do not begin working on this issue until triaged by the team labels Feb 24, 2026
@Sharra-writes

Sharra-writes commented Feb 24, 2026

Copy link
Copy Markdown
Contributor

@clwluvw I'll have to check in about this one since it's code security and altering code. Have to get extra approval for that.

@github-actions

github-actions Bot commented Apr 27, 2026

Copy link
Copy Markdown
Contributor

A stale label has been added to this pull request because it has been open 30 days with no activity. If you think this pull request should remain open, please add a new comment.

@github-actions github-actions Bot added the Inactive Will be closed automatically by a stall check if no activity is detected. label Apr 27, 2026
@Sharra-writes Sharra-writes removed the Inactive Will be closed automatically by a stall check if no activity is detected. label Apr 27, 2026
P1106480043

This comment was marked as spam.

Sign in to view

@subatoi subatoi added dependabot Content related to Dependabot and removed code security Content related to code security labels Sep 9, 2026
@subatoi

subatoi commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Hi @clwluvw, please accept my apologies for the late reply

I've investigated this, but I'm unable to produce it, and:

on:
  pull_request:
    types: [opened, reopened, synchronize]

Should be functionally equivalent to on: pull_request.

As such, I think something else may have happened here—possibly a bug—and if this is still relevant, I'd suggest one of three things:

Once again, please accept my apologies for the lateness, but under the circumstances I'm going to go ahead and close this out. Thank you for your interest in the GItHub docs

@subatoi subatoi closed this Sep 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Balanced
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
+1 more reviewer
@P1106480043 P1106480043 P1106480043 left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

content This issue or pull request belongs to the Docs Content team dependabot Content related to Dependabot

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@clwluvw @Sharra-writes @subatoi @P1106480043