Remove unnecessary secrets: inherit from auto-merge caller

[robnester-rh]

The shared auto-merge reusable workflow uses only the automatic GITHUB_TOKEN, which is provided to reusable workflows without secrets: inherit. Passing secrets: inherit therefore forwards all of this repository's secrets to the shared workflow for no functional benefit, widening the blast radius if that shared workflow were ever compromised.

The reusable workflow is already pinned to a commit SHA, and the caller's own permissions block (contents: write, pull-requests: write) is unchanged, so auto-merge behavior is unaffected.

Signed-off-by: Rob Nester rnester@redhat.com

Ref: EC-2051

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: e567c7e3-2a8a-4856-9a51-b793944c8c5d

📥 Commits

Reviewing files that changed from the base of the PR and between f8ca013 and f3e4e6f.

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yaml

💤 Files with no reviewable changes (1)

• .github/workflows/auto-merge.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The auto-merge workflow no longer inherits repository secrets. Its explicit pull-request and contents write permissions remain unchanged.

Changes

Auto-merge workflow

Layer / File(s)	Summary
Remove inherited secrets .github/workflows/auto-merge.yaml	Removed secrets: inherit from the reusable workflow job.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: acepresso, bohdanmar

Merge Risk: ⚪ Minimal · up to f3e4e

The workflow is intended to stop inheriting repository secrets without changing auto-merge permissions or behavior, so no material merge risk is identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the removal of unnecessary inherited secrets from the auto-merge caller.
Description check	✅ Passed	The description accurately explains the security rationale and confirms that permissions and auto-merge behavior remain unchanged.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Stop forwarding repository secrets to auto-merge workflow

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Stops forwarding repository secrets to the shared auto-merge workflow.
• Retains SHA pinning and required permissions without changing auto-merge behavior.

High-Level Assessment

Removing secrets: inherit is the optimal least-privilege approach because the reusable workflow only requires its automatic GITHUB_TOKEN. The existing SHA pin and explicit write permissions preserve functionality while avoiding unnecessary secret exposure.

Files changed (1) +0 / -1

Other (1) +0 / -1

auto-merge.yamlStop inheriting repository secrets in auto-merge +0/-1

Stop inheriting repository secrets in auto-merge

• Removes 'secrets: inherit' from the reusable auto-merge job, preventing repository secrets from being forwarded unnecessarily. The pinned workflow reference and required token permissions remain unchanged.

.github/workflows/auto-merge.yaml

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗