From ee5d480a391289c28e89eec0ccfb7ef059807798 Mon Sep 17 00:00:00 2001 From: Salah-Eddine Saakoun Date: Mon, 21 Sep 2026 17:22:32 +0200 Subject: [PATCH 1/5] fix: repair Renovate pull requests too --- .github/workflows/repair-dependabot-pull-requests.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/repair-dependabot-pull-requests.yml b/.github/workflows/repair-dependabot-pull-requests.yml index 849aceef9a8..7815cfbf6e3 100644 --- a/.github/workflows/repair-dependabot-pull-requests.yml +++ b/.github/workflows/repair-dependabot-pull-requests.yml @@ -1,4 +1,4 @@ -name: Repair Dependabot pull requests +name: Repair bot pull requests on: pull_request: @@ -13,8 +13,10 @@ permissions: jobs: repair: name: Repair constraints, lockfile and changelogs - if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }} + # Renovate pull requests are authored by `metamask-ci[bot]`, the identity of its token, so they are matched on the branch prefix instead. + if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || startsWith(github.event.pull_request.head.ref, 'renovate/') }} runs-on: ubuntu-latest + # The environment name and this file's name are both load bearing: the token exchange policy keys on the `environment` claim and globs on the workflow path. environment: dependabot permissions: contents: read From b3bab468fed65fa0e4b7a59d6b9ef61c4e867fc1 Mon Sep 17 00:00:00 2001 From: Salah-Eddine Saakoun Date: Mon, 21 Sep 2026 17:33:06 +0200 Subject: [PATCH 2/5] fix: name the workflow for what it repairs --- .github/workflows/repair-dependabot-pull-requests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/repair-dependabot-pull-requests.yml b/.github/workflows/repair-dependabot-pull-requests.yml index 7815cfbf6e3..68319f66a1b 100644 --- a/.github/workflows/repair-dependabot-pull-requests.yml +++ b/.github/workflows/repair-dependabot-pull-requests.yml @@ -1,4 +1,4 @@ -name: Repair bot pull requests +name: Repair dependency update pull requests on: pull_request: From b45af68bb8a8522e5e192ed9a9e560d5f46b5af2 Mon Sep 17 00:00:00 2001 From: Salah-Eddine Saakoun Date: Mon, 21 Sep 2026 17:51:32 +0200 Subject: [PATCH 3/5] fix: commit repairs under a distinct identity --- .github/workflows/repair-dependabot-pull-requests.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/repair-dependabot-pull-requests.yml b/.github/workflows/repair-dependabot-pull-requests.yml index 68319f66a1b..376fa9920b5 100644 --- a/.github/workflows/repair-dependabot-pull-requests.yml +++ b/.github/workflows/repair-dependabot-pull-requests.yml @@ -13,7 +13,6 @@ permissions: jobs: repair: name: Repair constraints, lockfile and changelogs - # Renovate pull requests are authored by `metamask-ci[bot]`, the identity of its token, so they are matched on the branch prefix instead. if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || startsWith(github.event.pull_request.head.ref, 'renovate/') }} runs-on: ubuntu-latest # The environment name and this file's name are both load bearing: the token exchange policy keys on the `environment` claim and globs on the workflow path. @@ -39,10 +38,11 @@ jobs: fetch-depth: 0 persist-credentials: false + # Deliberately not `metamask-ci[bot]`: that is the identity Renovate commits under, and Renovate only leaves a branch alone once it sees a commit from someone else. - name: Configure Git run: | - git config user.name 'metamask-ci[bot]' - git config user.email '271559518+metamask-ci[bot]@users.noreply.github.com' + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - name: Get merge base and starting commit id: refs From b55e36c9c4b526b6697951a3d02f8a7872b03b60 Mon Sep 17 00:00:00 2001 From: Salah-Eddine Saakoun Date: Mon, 21 Sep 2026 17:53:07 +0200 Subject: [PATCH 4/5] fix: say what the token exchange policy needs --- .github/workflows/repair-dependabot-pull-requests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/repair-dependabot-pull-requests.yml b/.github/workflows/repair-dependabot-pull-requests.yml index 376fa9920b5..8548b22fddd 100644 --- a/.github/workflows/repair-dependabot-pull-requests.yml +++ b/.github/workflows/repair-dependabot-pull-requests.yml @@ -15,7 +15,7 @@ jobs: name: Repair constraints, lockfile and changelogs if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || startsWith(github.event.pull_request.head.ref, 'renovate/') }} runs-on: ubuntu-latest - # The environment name and this file's name are both load bearing: the token exchange policy keys on the `environment` claim and globs on the workflow path. + # Renaming this environment or this file needs a matching change to the token exchange policy, which grants the token below based on both. environment: dependabot permissions: contents: read From bcbce01b4bb734d9d91567baaabb25882eee4d7a Mon Sep 17 00:00:00 2001 From: Salah-Eddine Saakoun Date: Mon, 21 Sep 2026 17:53:48 +0200 Subject: [PATCH 5/5] fix: drop the token exchange comment --- .github/workflows/repair-dependabot-pull-requests.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/repair-dependabot-pull-requests.yml b/.github/workflows/repair-dependabot-pull-requests.yml index 8548b22fddd..2446784b277 100644 --- a/.github/workflows/repair-dependabot-pull-requests.yml +++ b/.github/workflows/repair-dependabot-pull-requests.yml @@ -15,7 +15,6 @@ jobs: name: Repair constraints, lockfile and changelogs if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || startsWith(github.event.pull_request.head.ref, 'renovate/') }} runs-on: ubuntu-latest - # Renaming this environment or this file needs a matching change to the token exchange policy, which grants the token below based on both. environment: dependabot permissions: contents: read