Remove unnecessary secrets: inherit from auto-merge caller

[robnester-rh]

The shared auto-merge reusable workflow uses only the automatic GITHUB_TOKEN, which is provided to reusable workflows without secrets: inherit. Passing secrets: inherit therefore forwards all of this repository's secrets to the shared workflow for no functional benefit, widening the blast radius if that shared workflow were ever compromised.

The reusable workflow is already pinned to a commit SHA, and the caller's own permissions block (contents: write, pull-requests: write) is unchanged, so auto-merge behavior is unaffected.

Signed-off-by: Rob Nester rnester@redhat.com

Ref: EC-2051

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 591df8c3-030a-428e-8a7a-20bb681bb23a

📥 Commits

Reviewing files that changed from the base of the PR and between 5b9bec9 and 55e6ba3.

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yaml

💤 Files with no reviewable changes (1)

• .github/workflows/auto-merge.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The auto-merge workflow job no longer inherits repository secrets from the caller workflow. Its pull-request and contents write permissions remain configured.

Changes

Auto-merge permissions

Layer / File(s)	Summary
Remove inherited secrets .github/workflows/auto-merge.yaml	The auto-merge job no longer uses secrets: inherit. Its configured write permissions remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested reviewers: acepresso, bohdanmar

Merge Risk: ⚪ Minimal · up to 55e6b

The change removes unnecessary secret exposure while retaining the stated auto-merge permissions; no merge-blocking risk is identified in the supplied context.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes removal of unnecessary inherited secrets from the auto-merge caller.
Description check	✅ Passed	The description accurately explains the security rationale and confirms that permissions and auto-merge behavior remain unchanged.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Stop forwarding repository secrets to auto-merge workflow

⚙️ Configuration changes ✨ Enhancement 🕐 Less than 5 minutes

AI Description

• Removes unnecessary repository secret inheritance from the reusable auto-merge workflow.
• Reduces secret exposure while preserving existing token permissions and behavior.

High-Level Assessment

The least-privilege approach is optimal because the reusable workflow requires only the automatically supplied GITHUB_TOKEN. Explicitly forwarding selected secrets was considered unnecessary, while retaining secrets: inherit would preserve avoidable exposure.

Files changed (1) +0 / -1

Other (1) +0 / -1

auto-merge.yamlStop inheriting repository secrets in auto-merge +0/-1

Stop inheriting repository secrets in auto-merge

• Removes 'secrets: inherit' from the reusable auto-merge workflow invocation. Existing write permissions remain unchanged, preserving behavior while reducing the shared workflow's secret exposure.

.github/workflows/auto-merge.yaml

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each action level your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Single-line deletion from a CI workflow that removes an overly broad secrets permission; CI_WORKFLOW_CHANGED and a protected path lift the score to moderate, but the minimal scope, single author, no revert history, and high rollback safety cap the risk at 2.

[fullsend-ai-review]

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/auto-merge.yaml