Remove unnecessary secrets: inherit from auto-merge caller

[robnester-rh]

The shared auto-merge reusable workflow uses only the automatic GITHUB_TOKEN, which is provided to reusable workflows without secrets: inherit. Passing secrets: inherit therefore forwards all of this repository's secrets to the shared workflow for no functional benefit, widening the blast radius if that shared workflow were ever compromised.

The reusable workflow is already pinned to a commit SHA, and the caller's own permissions block (contents: write, pull-requests: write) is unchanged, so auto-merge behavior is unaffected.

Signed-off-by: Rob Nester rnester@redhat.com

Ref: EC-2051

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: dbac3aee-e5d8-4ed4-940d-69940286ea37

📥 Commits

Reviewing files that changed from the base of the PR and between af85f18 and 61e675b.

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yaml

💤 Files with no reviewable changes (1)

• .github/workflows/auto-merge.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The auto-merge reusable workflow job no longer inherits repository secrets.

Changes

Auto-merge workflow

Layer / File(s)	Summary
Remove inherited secrets .github/workflows/auto-merge.yaml	The reusable workflow job no longer uses secrets: inherit.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: acepresso, bohdanmar

Merge Risk: ⚪ Minimal · up to 61e67

The workflow reduces secret exposure without changing the documented auto-merge permissions or behavior.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the removal of unnecessary secrets inheritance from the auto-merge caller.
Description check	✅ Passed	The description accurately explains the removal of secrets: inherit, the security benefit, and the unchanged auto-merge permissions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Stop forwarding repository secrets to auto-merge workflow

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Prevents repository secrets from reaching the shared auto-merge workflow.
• Preserves existing auto-merge permissions and SHA-pinned workflow behavior.

High-Level Assessment

Removing secrets: inherit is the optimal least-privilege approach because the reusable workflow only requires the automatically provided GITHUB_TOKEN. Passing selected secrets was considered unnecessary because no additional secrets are consumed.

Files changed (1) +0 / -1

Other (1) +0 / -1

auto-merge.yamlStop inheriting repository secrets in auto-merge +0/-1

Stop inheriting repository secrets in auto-merge

• Removes 'secrets: inherit' from the reusable auto-merge workflow invocation. Existing write permissions and the SHA-pinned workflow reference remain unchanged.

.github/workflows/auto-merge.yaml

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗