From 91ca263470cd92107d02df3550df677967d68acd Mon Sep 17 00:00:00 2001
From: Yann Brillouet <ybrillou@redhat.com>
Date: Wed, 29 Jul 2026 10:39:48 +0200
Subject: [PATCH 1/2] PSIRTSUPT-20625: add provenance check to auto-merge flow

---
 .github/workflows/auto-merge.yml | 37 ++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 2b9c9a22..a76db5c4 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -8,6 +8,43 @@ jobs:
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
     steps:
+    - name: Verify Dependabot provenance
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        # 1. Verify actor
+        if [[ "${{ github.actor }}" != "dependabot[bot]" ]]; then
+          echo "::error::Invalid actor: ${{ github.actor }}"
+          exit 1
+        fi
+
+        # 2. Verify PR author type
+        AUTHOR_TYPE=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }} \
+          --jq '.user.type')
+
+        if [[ "$AUTHOR_TYPE" != "Bot" ]]; then
+          echo "::error::PR author is not a bot: $AUTHOR_TYPE"
+          exit 1
+        fi
+
+        # 3. Verify branch naming convention
+        if [[ ! "${{ github.event.pull_request.head.ref }}" =~ ^dependabot/ ]]; then
+          echo "::error::Branch doesn't match Dependabot pattern"
+          exit 1
+        fi
+
+        # 4. Verify commit signature
+        COMMIT_SHA="${{ github.event.pull_request.head.sha }}"
+        VERIFIED=$(gh api repos/${{ github.repository }}/commits/$COMMIT_SHA \
+          --jq '.commit.verification.verified')
+
+        if [[ "$VERIFIED" != "true" ]]; then
+          echo "::error::Commit not verified"
+          exit 1
+        fi
+
+        echo "✓ All provenance checks passed"
+
     - uses: ahmadnassri/action-dependabot-auto-merge@v2.6
       with:
         github-token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}'

From 3bcb645114fc0247bdc6f88fc4a251ff18202b19 Mon Sep 17 00:00:00 2001
From: Yann Brillouet <ybrillou@redhat.com>
Date: Wed, 29 Jul 2026 11:29:48 +0200
Subject: [PATCH 2/2] Address AI review comments + improve auto-merge step

---
 .github/workflows/auto-merge.yml | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index a76db5c4..013ba063 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -10,16 +10,21 @@ jobs:
     steps:
     - name: Verify Dependabot provenance
       env:
+        ACTOR: ${{ github.actor }}
+        GH_REPOSITORY: ${{ github.repository }}
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        PR_NUMBER: ${{ github.event.pull_request.number }}
       run: |
         # 1. Verify actor
-        if [[ "${{ github.actor }}" != "dependabot[bot]" ]]; then
-          echo "::error::Invalid actor: ${{ github.actor }}"
+        if [[ "$ACTOR" != "dependabot[bot]" ]]; then
+          echo "::error::Invalid actor: $ACTOR"
           exit 1
         fi
 
         # 2. Verify PR author type
-        AUTHOR_TYPE=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }} \
+        AUTHOR_TYPE=$(gh api repos/$GH_REPOSITORY/pulls/$PR_NUMBER \
           --jq '.user.type')
 
         if [[ "$AUTHOR_TYPE" != "Bot" ]]; then
@@ -28,14 +33,13 @@ jobs:
         fi
 
         # 3. Verify branch naming convention
-        if [[ ! "${{ github.event.pull_request.head.ref }}" =~ ^dependabot/ ]]; then
+        if [[ ! "$PR_HEAD_REF" =~ ^dependabot/ ]]; then
           echo "::error::Branch doesn't match Dependabot pattern"
           exit 1
         fi
 
         # 4. Verify commit signature
-        COMMIT_SHA="${{ github.event.pull_request.head.sha }}"
-        VERIFIED=$(gh api repos/${{ github.repository }}/commits/$COMMIT_SHA \
+        VERIFIED=$(gh api repos/$GH_REPOSITORY/commits/$PR_HEAD_SHA \
           --jq '.commit.verification.verified')
 
         if [[ "$VERIFIED" != "true" ]]; then
@@ -45,9 +49,8 @@ jobs:
 
         echo "✓ All provenance checks passed"
 
-    - uses: ahmadnassri/action-dependabot-auto-merge@v2.6
-      with:
-        github-token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}'
-        command: "squash and merge"
-        approve: true
-        target: minor
+    - name: Enable auto-merge for Dependabot PRs
+      run: gh pr merge --auto --squash "$PR_URL" && gh pr review --approve "$PR_URL"
+      env:
+        GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
+        PR_URL: ${{ github.event.pull_request.html_url }}