From 62185b028408e5cdad03899740b12380f20ff86a Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 25 Aug 2026 06:22:46 +0000 Subject: [PATCH] ci: allow a PAT to drive the cascade PR The default GITHUB_TOKEN can open/merge PRs, but pull_request-triggered checks (PHPUnit, PHPStan) on a PR it opens are held for manual approval by GitHub's anti-recursion safeguard, so the first cascade PR (#216) never got its required checks to run automatically. Prefer an optional CASCADE_TOKEN repo secret (a PAT with Contents: write, Pull requests: write) when set, falling back to GITHUB_TOKEN otherwise. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_013xfs2FHTpipY3LRBtC5vLK --- .github/workflows/cascade-merge.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cascade-merge.yml b/.github/workflows/cascade-merge.yml index 16e6007..12a0822 100644 --- a/.github/workflows/cascade-merge.yml +++ b/.github/workflows/cascade-merge.yml @@ -21,7 +21,13 @@ jobs: steps: - name: "Open or refresh the 4.x -> master pull request" env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # The default GITHUB_TOKEN can open/merge PRs, but pull_request-triggered + # workflows (required status checks) on a PR it opens are held for manual + # approval by GitHub's anti-recursion safeguard. Set the CASCADE_TOKEN repo + # secret to a PAT (Contents: write, Pull requests: write) so required checks + # on the cascade PR run without manual approval; falls back to GITHUB_TOKEN + # if unset (checks will need one-time manual approval in that case). + GH_TOKEN: ${{ secrets.CASCADE_TOKEN || secrets.GITHUB_TOKEN }} GH_REPO: ${{ github.repository }} run: | set -e