Remove unnecessary secrets: inherit from auto-merge caller

[robnester-rh]

The shared auto-merge reusable workflow uses only the automatic GITHUB_TOKEN, which is provided to reusable workflows without secrets: inherit. Passing secrets: inherit therefore forwards all of this repository's secrets to the shared workflow for no functional benefit, widening the blast radius if that shared workflow were ever compromised.

The reusable workflow is already pinned to a commit SHA, and the caller's own permissions block (contents: write, pull-requests: write) is unchanged, so auto-merge behavior is unaffected.

Signed-off-by: Rob Nester rnester@redhat.com

Ref: EC-2051

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 9a68e4f2-083f-4618-8ca9-b854805a49bd

📥 Commits

Reviewing files that changed from the base of the PR and between 880b375 and f92156c.

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yaml

💤 Files with no reviewable changes (1)

• .github/workflows/auto-merge.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The auto-merge workflow no longer inherits caller secrets when invoking its reusable workflow. Pull-request and contents write permissions remain unchanged.

Changes

Auto-merge workflow

Layer / File(s)	Summary
Remove caller secret inheritance .github/workflows/auto-merge.yaml	The reusable workflow invocation no longer forwards caller secrets. Existing write permissions remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Refactor

Suggested reviewers: acepresso, bohdanmar

Merge Risk: ⚪ Minimal · up to f9215

The workflow is intended to stop forwarding repository secrets while retaining its required permissions; no merge-blocking risk is evidenced, so it is mergeable.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: removing unnecessary inherited secrets from the auto-merge caller.
Description check	✅ Passed	The description accurately explains the security rationale and confirms that workflow permissions and behavior remain unchanged.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Stop forwarding repository secrets to auto-merge workflow

⚙️ Configuration changes ✨ Enhancement 🕐 Less than 5 minutes

AI Description

• Stops forwarding repository secrets to the shared auto-merge workflow.
• Preserves scoped GITHUB_TOKEN permissions and existing auto-merge behavior.

High-Level Assessment

Removing secrets: inherit is the least-privilege approach because the reusable workflow requires no caller secrets; an explicit allowlist would add no value. However, the PR description says the workflow is pinned to a commit SHA while this file references @main; that claim should be corrected or the reference should be pinned separately.

Files changed (1) +0 / -1

Other (1) +0 / -1

auto-merge.yamlStop inheriting repository secrets in auto-merge +0/-1

Stop inheriting repository secrets in auto-merge

• Removes implicit forwarding of all repository secrets to the shared reusable auto-merge workflow. The existing write permissions for pull requests and repository contents remain unchanged.

.github/workflows/auto-merge.yaml

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗