From 0e1b89b350336061eef9c9dd486e7860bbded14b Mon Sep 17 00:00:00 2001 From: Jon Bogaty Date: Mon, 27 Jul 2026 00:30:27 -0500 Subject: [PATCH] ci: allow required checks to run on bot-authored PRs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Both required status checks (`validate`, `build-site`) only triggered on `pull_request`. GitHub deliberately does not fire `pull_request` for PRs opened with the default GITHUB_TOKEN, to avoid recursive workflow runs. release-please opens its release PR with GITHUB_TOKEN, so neither required check ever reported on it. With `enforce_admins: true` and both contexts required, that left the release PR permanently BLOCKED with zero check runs — unmergeable by any means short of weakening branch protection. Adds `workflow_dispatch` to validate-packages.yml (ci.yml already had it) so both required contexts can be run against such a branch and report status. Comments on both triggers record why they must stay. The alternative — giving release-please a PAT — needs an interactively created secret and trades a deadlock for a long-lived credential; this keeps branch protection intact and adds no secret. --- .github/workflows/ci.yml | 4 ++++ .github/workflows/validate-packages.yml | 5 +++++ 2 files changed, 9 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a481f70..3112f52 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,6 +2,10 @@ name: CI on: pull_request: + # `build-site` is a required status check. PRs opened by GITHUB_TOKEN + # (notably release-please's) do not fire `pull_request`, so the check never + # reports and those PRs stay permanently BLOCKED. workflow_dispatch lets the + # run be started against the PR's branch so the required context can report. workflow_dispatch: permissions: diff --git a/.github/workflows/validate-packages.yml b/.github/workflows/validate-packages.yml index ea09e50..1acd2c0 100644 --- a/.github/workflows/validate-packages.yml +++ b/.github/workflows/validate-packages.yml @@ -4,6 +4,11 @@ on: pull_request: push: branches: ["main"] + # `validate` is a required status check. PRs opened by GITHUB_TOKEN (notably + # release-please's) do not fire `pull_request`, so the check never reports and + # those PRs stay permanently BLOCKED. workflow_dispatch lets the run be + # started against the PR's branch so the required context can report. + workflow_dispatch: permissions: contents: read