Automerge of dependabot pull request stuck when pushing a commit with `GITHUB_TOKEN`

[rsteube]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/automating-dependabot-with-github-actions

What part(s) of the article would you like to see updated?

When modifying a pull request opened by dependabot using the GITHUB_TOKEN the automerge process is stuck.
Seems this token does not trigger the automerge workflow (of github) and one needs to use a user/bot PAT.

The workflow runs recommended in automating-dependabot-with-github-actions are successful though so as a user it is hard to identify the issue.

Might be good to add another bulletpoint to the investigating-failed-workflow-runs that the GITHUB_TOKEN shouldn't be used for a push.

Additional information

see https://github.com/community/maintainers/discussions/686

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[jsoref]

I'm not sure what portion of readers here have access to the referenced repository (it is members only). But I support the request here.

[wawaradenhawariah-prog]

🙏😊

[Sharra-writes]

@rsteube Let me make sure this is the intended behavior, and then we can figure out how to fix the docs.

[rsteube]

Sure. There still seems to be some flakyness to the solution in the related discussion (e.g. I just had to merge carapace-sh/carapace-aws#229 manually).

[Sharra-writes]

@rsteube Our engineers want to investigate this further and are wondering if you have specific examples of it not working, maybe with logs showing what was happening (that would be convenient, but specific examples would still be helpful).

[rsteube]

Whenever there is an update to aws cli:

carapace-sh/carapace-aws#231
https://github.com/carapace-sh/carapace-aws/actions/runs/22078441245
https://github.com/carapace-sh/carapace-aws/actions/runs/22078441248

https://github.com/carapace-sh/carapace-aws/blob/master/.github/workflows/dependabot.yml

Changing the GITHUB_TOKEN to DEPENDABOT_TOKEN (pat) worked before, but the last couple PRs were stuck in the same way.

[rsteube]

This is how it looked like when it was stuck initially (where i pushed the commit with GITHUB_TOKEN).
Builds don't get triggered for e24f69c and 973185d (which is fine for me).
Approval and auto-merge are successfully, but the whole PR waits for requirements to be met that don't exist (or at least they are not visible to me).
This might be due to no buld running or some kind of race condition.

[Sharra-writes]

@rsteube Thanks for getting back to us so fast! I'll link these comments for our engineers and let you know what they find when I've got something to report. 💛

[rsteube]

There’s one thing I haven’t thought about: could this be related to self-approval?

[rsteube]

There’s one thing I haven’t thought about: could this be related to self-approval?

Just approved carapace-sh/carapace-aws#236 with my own account (not the bot) and the merge went through.
What's weird though is that this wasn't necessary for previous pull requests.