From fe7dc3be0de501466eda816c907e83d3e7564291 Mon Sep 17 00:00:00 2001
From: Bibek Chaudhary <85162559+bbkrr@users.noreply.github.com>
Date: Wed, 1 Jul 2026 14:39:25 +0545
Subject: [PATCH] Revert to pull_request_target: required workflows can't be
 reusable

GitHub's 'require workflows to pass' ruleset rejects a workflow_call-only
workflow ('must have merge_queue, pull_request_target, or pull_request').
Converting this to reusable (PR #1) broke the org dependabot-automerge
ruleset for every repo. Restore the direct pull_request_target trigger so
the org ruleset can inject and run it across repos as intended. Keeps the
PR-author guard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/dependabot-automerge.yaml | 29 ++++++---------------
 1 file changed, 8 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/dependabot-automerge.yaml b/.github/workflows/dependabot-automerge.yaml
index 137b734..57c2d9a 100644
--- a/.github/workflows/dependabot-automerge.yaml
+++ b/.github/workflows/dependabot-automerge.yaml
@@ -1,31 +1,18 @@
 name: Dependabot Auto-Merge
 
-# Reusable workflow: call it from a repo with a thin caller that triggers on
-# pull_request_target and passes secrets, e.g.:
-#
-#   on:
-#     pull_request_target:
-#       types: [opened, synchronize]
-#       branches: [main]        # your default branch
-#   permissions:
-#     contents: write
-#     pull-requests: write
-#     issues: write
-#   jobs:
-#     auto-merge:
-#       # Guard on the PR *author* (not github.actor, which is the triggering
-#       # user and can be a maintainer on a rebase/synchronize). Keeps secrets
-#       # away from non-Dependabot (incl. fork) PRs while still running for every
-#       # Dependabot-authored PR regardless of who triggered the event.
-#       if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
-#       uses: realrate/.github/.github/workflows/dependabot-automerge.yaml@main
-#       secrets: inherit
+# Org-wide Dependabot auto-merge. This workflow is referenced by the org
+# `dependabot-automerge` ruleset ("Require workflows to pass before merging"),
+# which INJECTS and runs it on Dependabot PRs across every targeted repo — so
+# individual repos do NOT need their own copy or a caller. GitHub requires the
+# referenced workflow to be directly PR-triggerable (pull_request_target /
+# pull_request / merge_queue); it must NOT be a reusable (workflow_call) workflow.
 #
 # For patch/minor bumps it approves the PR and enables auto-merge (rebase); for
 # major bumps it comments and labels `needs-manual-review` for a human.
 
 on:
-  workflow_call:
+  pull_request_target:
+    types: [opened, synchronize]
 
 permissions:
   contents: write