Dependabot PR全检查通过后自动合并的工作流异常问题

使用workflow_run作为触发事件时，工作流默认上下文仅包含被触发运行的工作流元数据，不会直接携带对应PR的pull_request载荷，直接读取PR上下文就会报属性不存在的错误。同时Dependabot提交的PR属于GitHub机器人触发的特殊场景，需要单独配置工作流权限，否则会出现权限不足无法执行合并的问题。

方案1：基于原有workflow_run触发逻辑改造（推荐） #

不需要修改原有触发规则，通过GitHub API从workflow_run上下文反查关联PR信息，同时配置正确的工作流权限，完整可复用配置如下：

name: Auto Merge Dependabot PR
on:
  workflow_run:
    workflows: ["Lint and Unit tests"]
    types:
      - completed

permissions:
  contents: write
  pull-requests: write
  actions: read

jobs:
  auto-merge-dependabot:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.actor == 'dependabot[bot]' }}
    steps:
      - name: Extract associated PR number
        id: get-pr
        uses: actions/github-script@v7
        with:
          script: |
            const prNumber = context.payload.workflow_run.pull_requests[0]?.number;
            if (!prNumber) {
              core.setFailed('No matched PR found for current workflow run');
              return;
            }
            core.setOutput('pr_number', prNumber);

      - name: Verify all PR checks passed
        id: check-status
        uses: actions/github-script@v7
        with:
          script: |
            const checkRes = await github.rest.checks.listForRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: context.payload.workflow_run.head_sha,
            });
            const allPass = checkRes.data.check_runs.every(item => item.status === 'completed' && item.conclusion === 'success');
            if (!allPass) {
              core.setFailed('Existing failed checks, skip merge');
              return;
            }
            core.setOutput('pass', 'true');

      - name: Merge qualified PR
        if: steps.check-status.outputs.pass == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.pulls.merge({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: ${{ steps.get-pr.outputs.pr_number }},
              merge_method: 'squash'
            });

配置说明：

• 第一层判断直接过滤掉工作流运行失败、非Dependabot触发的运行，减少无效执行
• 不需要依赖默认上下文的pull_request载荷，直接从workflow_run事件的返回值里提取关联PR编号
• 主动拉取PR对应提交的所有检查项状态二次校验，避免漏过其他未纳入触发工作流的失败检查
• 合并方式可根据仓库实际规则调整，支持squash/merge/rebase三种选项

方案2：基于pull_request_target事件的简化实现 #

如果不需要严格绑定指定工作流的完成状态，也可以直接用pull_request_target事件触发，该事件上下文原生携带完整PR payload，配置更简单：

name: Auto Merge Dependabot PR
on:
  pull_request_target:
    branches: [main] # 替换为仓库默认分支名

permissions:
  contents: write
  pull-requests: write

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      - name: Wait for all checks completed
        uses: actions/github-script@v7
        with:
          script: |
            let allPass = false;
            // 轮询检查状态，最长等待10分钟
            for (let i=0; i<60; i++) {
              const res = await github.rest.checks.listForRef({
                owner: context.repo.owner,
                repo: context.repo.repo,
                ref: context.payload.pull_request.head.sha
              });
              const finished = res.data.check_runs.every(item => item.status === 'completed');
              if (finished) {
                allPass = res.data.check_runs.every(item => item.conclusion === 'success');
                break;
              }
              await new Promise(resolve => setTimeout(resolve, 10000));
            }
            if (!allPass) core.setFailed('Checks not all passed within timeout');

      - name: Merge PR
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.pulls.merge({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: ${{ github.event.pull_request.number }},
              merge_method: 'squash'
            });

• 禁止用普通pull_request事件触发Dependabot PR的合并逻辑，该场景下工作流默认只有只读权限，无法执行合并操作，必须使用workflow_run或pull_request_target这类在仓库默认分支上下文运行的触发事件
• 如果仓库配置了分支保护规则，需要确保工作流使用的GITHUB_TOKEN拥有对应分支的合并权限，或在分支保护规则中允许管理员账号绕过限制
• 配置上线前建议先创建测试PR验证逻辑，避免误合并不符合要求的PR

内容的提问来源于stack exchange，提问作者user16578778