From f15576e411a44e17c23f300c3b51973809ef203a Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 1 Jul 2026 17:35:10 +0000 Subject: [PATCH 1/2] ci(merge-queue): only run queue job when the queue label is added The Merge Queue workflow triggers on pull_request: types: [labeled], so it fired the merge-queue action on every label. On Dependabot PRs GitHub withholds secrets.MERGE_QUEUE_TOKEN from the run, so the action failed with "Input required and not supplied: token" the moment Dependabot's auto-applied `dependencies`/`go` labels landed (e.g. #716). Guard the job with an `if` so the action only engages when the added label is `queue` (or on manual dispatch). Non-queue label events skip the job cleanly instead of failing, and no secret is exposed to Dependabot-authored runs. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01SKpGw8pbTZHUJsyoFQBs4o --- .github/workflows/merge-queue.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/merge-queue.yml b/.github/workflows/merge-queue.yml index 5e4c87d93..fbfa496e3 100644 --- a/.github/workflows/merge-queue.yml +++ b/.github/workflows/merge-queue.yml @@ -24,6 +24,15 @@ permissions: jobs: queue: + # Only engage the merge-queue action when the `queue` label is the one + # being added (or on manual dispatch). Firing on any label makes the job + # run for routine labels like Dependabot's `dependencies`/`go`, where + # secrets.MERGE_QUEUE_TOKEN is withheld from the run and the action fails + # with "Input required and not supplied: token". Guarding on the label + # name skips those events cleanly instead of exposing the token. + if: >- + github.event_name == 'workflow_dispatch' || + github.event.label.name == 'queue' runs-on: ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 From dd46c36a51a1d2e9399beea3af1f712f22035132 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 1 Jul 2026 17:37:34 +0000 Subject: [PATCH 2/2] docs(merge-queue): reword guard comment to not imply prior token exposure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Secrets are already withheld from Dependabot-authored runs, so the guard prevents a noisy failure on the absent token — it does not change token exposure. Reword the comment accordingly. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01SKpGw8pbTZHUJsyoFQBs4o --- .github/workflows/merge-queue.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/merge-queue.yml b/.github/workflows/merge-queue.yml index fbfa496e3..4ffbee898 100644 --- a/.github/workflows/merge-queue.yml +++ b/.github/workflows/merge-queue.yml @@ -29,7 +29,7 @@ jobs: # run for routine labels like Dependabot's `dependencies`/`go`, where # secrets.MERGE_QUEUE_TOKEN is withheld from the run and the action fails # with "Input required and not supplied: token". Guarding on the label - # name skips those events cleanly instead of exposing the token. + # name skips those events cleanly instead of failing on the absent token. if: >- github.event_name == 'workflow_dispatch' || github.event.label.name == 'queue'