Github Action to open PR and auto merge it #13344

Re-reading the full snippet — you're already using gh pr merge --auto --squash, so the question isn't how, it's why the warning fires. That message (failed to enable auto-merge) on GHES with the default GITHUB_TOKEN
almost always comes down to one of these:

1. No branch protection on main. --auto enables a queue that waits for required checks/reviews. If main has zero protection rules, there's nothing to queue against and GitHub refuses to enable auto-merge. Fix: add a
   branch protection rule on main with at least one required status check (or required review) — even a minimal "lint" check is enough.

2. GITHUB_TOKEN can't enable auto-merge for PRs it created in some GHES configs. This is a deliberate restriction to prevent runaway automation loops. Workaround: create a fine-grained PAT (or use a GitHub App
   installation token) with contents: write + pull-requests: write, store it as secrets.AUTOMERGE_PAT, and switch the env to GH_TOKEN: ${{ secrets.AUTOMERGE_PAT }} only for the gh pr merge step. The PR opens with
   GITHUB_TOKEN, the merge enables with the PAT.

3. Enterprise/org-level policy. Auto-merge has to be enabled at three levels on GHES: enterprise → org → repo. Repo-level alone is not enough if the enterprise admin disabled it upstream. Check with your GHES admin or look
   in Site admin → Enterprise overview → Policies → Repository policies.

If you can share the GHES version (testcloud.ghe.com is presumably internal), I can be more specific — auto-merge had several bug fixes between 3.6 and 3.10.

For reference, here's a complete working pattern that combines gh pr create + gh pr merge --auto:

jobs:                                                                                                                                                                                                                              
  open-pr:                                                                                                        
    runs-on: ubuntu-latest             
    permissions:
      contents: write
      pull-requests: write                                                                                                                                                                                                         
    steps:
      - uses: actions/checkout@v4                                                                                                                                                                                                  
      - name: Open PR and enable auto-merge                                                                       
        env:                                                                                                                                                                                                                       
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |                                                                                                                                                                                                                     
          PR_URL=$(gh pr create \                                                                                                                                                                                                  
            --base main \              
            --head "${GITHUB_REF_NAME}" \                                                                                                                                                                                          
            --title "FluxCD image update" \                                                                                                                                                                                        
            --body "Automated PR from FluxCD branch" \                                                                                                                                                                             
            --fill)                                                                                                                                                                                                                
          gh pr merge "$PR_URL" --auto --squash --delete-branch                                                                                                                                                                    

Three repo-side prereqs for --auto to actually fire:

1. Repo setting: Settings → General → Pull Requests → check Allow auto-merge
2. Branch protection: required (per cause interactive pr list #1 above)
3. Token: see cause Reimagine how the app determines its context #2 above for GHES specifically

The warning usually comes down to one of two things — and the first is the common one:

1) There's no branch protection with pending checks/reviews on the base branch. --auto doesn't merge immediately; it enables auto-merge, which only applies when a PR cannot be merged right away. Per the docs, the auto-merge option "is shown only on pull requests that cannot be merged immediately" — e.g. when a branch protection rule requires reviews or status checks that aren't met yet (https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request). If nothing is required, there's nothing to wait for, so enabling auto-merge fails. In that case just merge directly:

gh pr merge "$PR_NUMBER" --squash --delete-branch

2) Token permissions and the GITHUB_TOKEN self-trigger limit.

• Give the job write access:

permissions:
  contents: write
  pull-requests: write

• And a subtle one: a PR or commit created with the default GITHUB_TOKEN does not start new workflow runs — "events triggered by the GITHUB_TOKEN will not create a new workflow run" (https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow). So if the required checks are supposed to run on the bot's PR, they never start and auto-merge waits forever. Create the PR with a PAT or GitHub App token so the checks actually run.

A pattern that waits for checks:

env:
  GH_TOKEN: ${{ secrets.AUTOMERGE_PAT }}   # not the default token, so checks run
run: |
  gh pr create --fill --base main --head "$BRANCH"
  gh pr merge --squash --auto              # merges once required checks pass

On GHES or under an org policy, auto-merge can also be disabled centrally — then it won't enable until an admin turns it on. Token permissions reference: https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication

The error Resource not accessible by integration (enablePullRequestAutoMerge) almost always means the GITHUB_TOKEN cannot call the enablePullRequestAutoMerge mutation in your environment — even when the repo UI shows auto-merge enabled.

1. Add the missing permission

enablePullRequestAutoMerge needs pull-requests: write (you have this) and often works more reliably with explicit GraphQL permissions on newer runners:

permissions:
  contents: write
  pull-requests: write

You already set that — good. On GitHub Enterprise Server, also confirm the instance allows auto-merge for the repo (admin setting).

2. Prefer gh pr merge --auto after PR exists and checks pass

Your script is close. A more reliable pattern:

- name: Create or update PR
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    BRANCH: ${{ github.ref_name }}
  run: |
    PR_NUMBER=$(gh pr list --head "$BRANCH" --base main --state open --json number --jq '.[0].number // empty')

    if [ -z "$PR_NUMBER" ]; then
      PR_URL=$(gh pr create --title "Flux image update: $BRANCH" --body "Automated PR" --head "$BRANCH" --base main)
      PR_NUMBER="${PR_URL##*/}"
    fi

    gh pr merge "$PR_NUMBER" --auto --squash

3. Use a PAT/App token if GITHUB_TOKEN is blocked

In some GHE setups, the built-in token cannot enable auto-merge via API. Fix options:

• Create a fine-grained PAT or GitHub App with Contents: Read/Write + Pull requests: Read/Write
• Store as GH_TOKEN: ${{ secrets.FLUX_PR_TOKEN }}
• Ensure the token owner has permission to enable auto-merge on the repo

4. Branch protection caveats

Auto-merge only completes when:

• Required checks are green
• Required reviews are satisfied (if configured)
• No merge queue conflicts

--auto queues merge; it does not force-merge immediately.

5. GHE host flag

You set GH_HOST: testcloud.ghe.com — also export it for every gh step and verify gh auth status inside the job if debugging.

Quick test in the workflow:

gh api graphql -f query='mutation { enablePullRequestAutoMerge(input: {pullRequestId: "PR_NODE_ID"}) { clientMutationId } }'

If that fails with the same error, switch from GITHUB_TOKEN to a PAT/App token with merge rights.

GITHUB_TOKEN in Actions cannot call enablePullRequestAutoMerge — that GraphQL mutation requires elevated permissions the default token does not grant, even when auto-merge is enabled on the repo.

Fix: add explicit permissions + use a PAT for auto-merge

permissions:
  contents: write
  pull-requests: write

jobs:
  open-pr:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Create PR and enable auto-merge
        env:
          GH_HOST: testcloud.ghe.com
          GH_TOKEN: ${{ secrets.FLUX_AUTOMERGE_PAT }}  # not github.token
          BRANCH: ${{ github.ref_name }}
        run: |
          PR_NUMBER=$(gh pr list --head "${BRANCH}" --base main --state open --json number --jq '.[0].number // empty')

          if [[ -z "${PR_NUMBER}" ]]; then
            PR_URL=$(gh pr create \
              --title "Flux image update: ${BRANCH}" \
              --body "Automated PR from Flux update branch." \
              --head "${BRANCH}" \
              --base main)
            PR_NUMBER="${PR_URL##*/}"
          fi

          gh pr merge "${PR_NUMBER}" --auto --squash

PAT requirements

Create a fine-grained or classic PAT with:

• Contents: Read and write
• Pull requests: Read and write

Store as FLUX_AUTOMERGE_PAT in repo/org secrets.

Also verify on GHE

1. Repo Settings → General → Allow auto-merge is enabled
2. Branch protection allows auto-merge (required checks must pass first — auto-merge waits for them)
3. On GHE, confirm your instance version supports gh pr merge --auto with PATs

Why github.token fails

The default GITHUB_TOKEN is intentionally restricted from enabling auto-merge on PRs it did not fully authorize. GitHub documents this under Actions token permissions — enablePullRequestAutoMerge is not in the default scope.

Fallback without auto-merge

If PAT is not an option, merge directly when checks pass:

gh pr merge "$PR_NUMBER" --squash --admin

(--admin only works if the token has bypass rights.)

The error GraphQL: Resource not accessible by integration (enablePullRequestAutoMerge) means the default GITHUB_TOKEN does not have permission to enable auto-merge.

To fix this:

1. In your repository on GitHub, go to Settings > Actions > General.
2. Scroll down to Workflow permissions.
3. Check the box for "Allow GitHub Actions to create and approve pull requests".
4. Click Save.

Once enabled, gh pr merge --auto using ${{ github.token }} will be allowed to set auto-merge on the PR.

The error tells you exactly which of the three preconditions is missing. Check them in this order:

1. Branch protection on the base branch. gh pr merge --auto only queues a merge - it requires the PR to be currently unmergeable (required checks or reviews pending). With zero protection rules on main there is nothing to wait for, so enabling auto-merge fails. Fix: add a protection rule on main with at least one required check. If you actually want an immediate merge with no gates, skip --auto and run gh pr merge --squash directly.

2. Token capability. enablePullRequestAutoMerge is not callable by the default GITHUB_TOKEN in several GHES configurations, even with pull-requests: write and repo-level auto-merge enabled. Fix: switch only the merge step to a fine-grained PAT or GitHub App token (contents + pull-requests write) stored as a secret; keep creating the PR with github.token.

3. Enterprise/org policy. On GHES, auto-merge must be allowed at enterprise -> org -> repo levels. Repo-level alone is not enough if it is disabled upstream - check with your GHES admin.

One more trap specific to your setup: commits created by the default GITHUB_TOKEN do not trigger new workflow runs, so if the required checks are supposed to run on the bot-pushed branch, they never start and auto-merge waits forever (documented under "Triggering a workflow from a workflow"). Using a PAT/App token for the push and PR steps fixes that too.