From 07f234293497c698a8b9a57894b74209fa89a83b Mon Sep 17 00:00:00 2001
From: Prasanth Baskar <prasanth@8gears.com>
Date: Wed, 23 Sep 2026 11:12:53 +0530
Subject: [PATCH] ci: only open update PRs from schedule, dispatch and push

On pull_request and merge_group the checker still runs as a check,
but create-pull-request no longer fires there. It was failing with
"GitHub Actions is not permitted to create or approve pull requests"
on every PR and leaving a create-pull-request/patch-* branch behind
each time. Adds workflow_dispatch for manual runs.

Checker runs repo-controlled code on PR refs, so it is now its own
job with a read-only token. PR creation moved to a second job that
gets the write token only on schedule, dispatch and push, taking the
checker output via artifact.

Signed-off-by: Prasanth Baskar <prasanth@8gears.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/workflows/check_updates.yml | 35 +++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check_updates.yml b/.github/workflows/check_updates.yml
index baebbde..4b4b821 100644
--- a/.github/workflows/check_updates.yml
+++ b/.github/workflows/check_updates.yml
@@ -9,12 +9,14 @@ on:
   merge_group:
   schedule:
     - cron: '0 0 * * *'  # Runs everyday
+  workflow_dispatch:
 
 jobs:
   check-for-updates:
+    # Runs repo-controlled code (./newver-checker) on PR and queue refs,
+    # so this job only ever gets a read-only token.
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     runs-on: ubuntu-latest  # Use an Ubuntu runner
     steps:
       - name: Checkout repository
@@ -52,9 +54,34 @@ jobs:
             echo '```'
           } > pr_body.md
 
+      - name: Upload checker output
+        uses: actions/upload-artifact@v7
+        with:
+          name: nvchecker
+          path: |
+            nvchecker.log
+            pr_body.md
+
+  open-update-pr:
+    # PR and queue runs only verify the checker works. Opening update PRs
+    # from them spams branches and needs PR-creation rights the token lacks.
+    # Only this job holds a write token, and only on trusted events.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.event_name == 'push'
+    needs: check-for-updates
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download checker output
+        uses: actions/download-artifact@v7
+        with:
+          name: nvchecker
+
       - name: Create Pull Request
-        # queue branches only verify the checker runs; never open PRs from them
-        if: github.event_name != 'merge_group'
         uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}