ΒUG: Unable to bypass branch protection rules about automerge-action HOT 5 CLOSED

Yes, that could be a bug. Can you try enabling debug logs as described in https://github.com/pascalgn/automerge-action#debugging and see if that gives any hints/info?

from automerge-action.

We seem to have encountered the same bug. So here is a Trace log output to help you in trouble shooting.

I'm not 100% sure it is the same, but from what I see of the issue description it looks very much the same what happens in our case.

Some details have been removed for security.
There was a lot of it so made a pastebin rather than even try to get it nicely formatted in here

from automerge-action.

I spent a couple of hours last night digging through what is happening. And I belive now that this isn't a bug on your part @pascalgn. When a PR have "Require approvals" enabled it can't be merge through API or otherwise. As seen in your error handling code, that error is already in there. And in the array MAYBE_READY the 'blocked' status isn't in there.

I forked your repo and tried to add 'blocked' to see if there is a way to go around branch protection rules when "Require approvals" is enabled. And there isn't really a good way.

What I can say worked after some research on the topic is that you can have another action first approve the PR. This is however not without risk as laid out here https://medium.com/cider-sec/bypassing-required-reviews-using-github-actions-6e1b29135cc7

So, for any one else stumbling on this and woundering. The solution is:

• to make sure "Allow GitHub Actions reviews to count towards required approval" to be set on the repo.
• have the number of approvals required be 1
• run a auto approve action first, example: https://github.com/hmarr/auto-approve-action and make sure it is only run for PRs you intend to handle automatically
• then lastly run this action on the now approved PR which will then stop being 'blocked' and will enter a state where it can be automerged

I set up a test in my private account where you can see an example solution I made: https://github.com/aiqueneldar/tests/blob/main/.github/workflows/automerge.yml

In conclusion, I think this can be closed. And I hope this will help future people.

from automerge-action.

I close this now, as suggested, even though it wasn't the original author. If you feel this issue is still needed, please let me know!

from automerge-action.

For the googlers: "Allow GitHub Actions reviews to count towards required approval" is in your organizations settings (https://github.com/organizations/ORGNAME/settings/actions) at the very end at "Workflow permissions"

from automerge-action.