Github Action to open PR and auto merge it #13344

AleksandarTokarev · 2026-05-04T13:52:20Z

AleksandarTokarev
May 4, 2026

Hello,
We are doing a migration to Kubernetes AKS and we are using FluxCD for image automation.
When FluxCD detects a new image in the Container Registry - it pushes to a specific branch in the github enterprise repo that we have.
We have created a Github Action which Opens a PR, but we want to merge this PR automatically as well.
Here is the github action

name: Open PR from Flux Branch

on:
  push:
    branches:
      - 'flux/update-policy-*'

permissions:
  contents: write
  pull-requests: write

jobs:
  open-pr:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Create PR and enable auto-merge
        env:
          GH_HOST: testcloud.ghe.com
          GH_TOKEN: ${{ github.token }}
          BRANCH: ${{ github.ref_name }}
        run: |
          # 1. Look for an existing open PR for this branch
          PR_NUMBER=$(gh pr list --head "${BRANCH}" --base main --state open --json number --jq '.[0].number // empty')

          if [[ -z "${PR_NUMBER}" ]]; then
            echo "No existing PR found. Creating..."
            if PR_URL=$(gh pr create \
                --title "Flux image update: ${BRANCH}" \
                --body "Automated PR from Flux update branch." \
                --head "${BRANCH}" \
                --base main); then
              PR_NUMBER="${PR_URL##*/}"
              echo "Created PR #${PR_NUMBER}: ${PR_URL}"
            else
              echo "Warning: PR creation failed. Ensure ${BRANCH} has actual commit differences from main."
              exit 0
            fi
          else
            echo "An open PR already exists for ${BRANCH}: #${PR_NUMBER}"
          fi

          # 2. Enable auto-merge (no-op if already enabled). Merges once required
          # checks and reviews are satisfied per branch protection.
          echo "Enabling auto-merge on PR #${PR_NUMBER}..."
          gh pr merge "${PR_NUMBER}" --auto --squash \
            || echo "Warning: failed to enable auto-merge. Verify repo auto-merge is enabled and the token has sufficient permissions."

The logs/error that we are getting is the following:

 Warning: failed to enable auto-merge. Verify repo auto-merge is enabled and the token has sufficient permissions.

Auto merge is enabled on the repo.
We are using the default injected Github Token - https://docs.github.com/en/actions/tutorials/authenticate-with-github_token

ThiagoMafra-Integrare · 2026-05-04T22:59:21Z

ThiagoMafra-Integrare
May 4, 2026

Re-reading the full snippet — you're already using gh pr merge --auto --squash, so the question isn't how, it's why the warning fires. That message (failed to enable auto-merge) on GHES with the default GITHUB_TOKEN
almost always comes down to one of these:

No branch protection on main. --auto enables a queue that waits for required checks/reviews. If main has zero protection rules, there's nothing to queue against and GitHub refuses to enable auto-merge. Fix: add a
branch protection rule on main with at least one required status check (or required review) — even a minimal "lint" check is enough.
GITHUB_TOKEN can't enable auto-merge for PRs it created in some GHES configs. This is a deliberate restriction to prevent runaway automation loops. Workaround: create a fine-grained PAT (or use a GitHub App
installation token) with contents: write + pull-requests: write, store it as secrets.AUTOMERGE_PAT, and switch the env to GH_TOKEN: ${{ secrets.AUTOMERGE_PAT }} only for the gh pr merge step. The PR opens with
GITHUB_TOKEN, the merge enables with the PAT.
Enterprise/org-level policy. Auto-merge has to be enabled at three levels on GHES: enterprise → org → repo. Repo-level alone is not enough if the enterprise admin disabled it upstream. Check with your GHES admin or look
in Site admin → Enterprise overview → Policies → Repository policies.

If you can share the GHES version (testcloud.ghe.com is presumably internal), I can be more specific — auto-merge had several bug fixes between 3.6 and 3.10.

For reference, here's a complete working pattern that combines gh pr create + gh pr merge --auto:

jobs:                                                                                                                                                                                                                              
  open-pr:                                                                                                        
    runs-on: ubuntu-latest             
    permissions:
      contents: write
      pull-requests: write                                                                                                                                                                                                         
    steps:
      - uses: actions/checkout@v4                                                                                                                                                                                                  
      - name: Open PR and enable auto-merge                                                                       
        env:                                                                                                                                                                                                                       
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |                                                                                                                                                                                                                     
          PR_URL=$(gh pr create \                                                                                                                                                                                                  
            --base main \              
            --head "${GITHUB_REF_NAME}" \                                                                                                                                                                                          
            --title "FluxCD image update" \                                                                                                                                                                                        
            --body "Automated PR from FluxCD branch" \                                                                                                                                                                             
            --fill)                                                                                                                                                                                                                
          gh pr merge "$PR_URL" --auto --squash --delete-branch

Three repo-side prereqs for --auto to actually fire:

Repo setting: Settings → General → Pull Requests → check Allow auto-merge
Branch protection: required (per cause interactive pr list #1 above)
Token: see cause Reimagine how the app determines its context #2 above for GHES specifically

0 replies

This comment was marked as spam.

Sign in to view

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Github Action to open PR and auto merge it #13344

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments

This comment was marked as spam.

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Github Action to open PR and auto merge it #13344

Uh oh!

Uh oh!

AleksandarTokarev May 4, 2026

Replies: 2 comments

This comment was marked as spam.

Uh oh!

Uh oh!

ThiagoMafra-Integrare May 4, 2026

AleksandarTokarev
May 4, 2026

ThiagoMafra-Integrare
May 4, 2026