From 36badfa9b00de43b132970d1bc9a53bdafbcf260 Mon Sep 17 00:00:00 2001 From: "fr4nc1sc0.r4m0n" Date: Tue, 20 Oct 2026 12:39:31 +0200 Subject: [PATCH 1/3] Mint a Vault token before copying Mergify backport labels. GITHUB_TOKEN label writes do not retrigger pull_request labeled workflows, so oblt-aw automerge never starts on merge-ready backports. --- .github/workflows/mergify-labels-copier.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/mergify-labels-copier.yml b/.github/workflows/mergify-labels-copier.yml index d5ff3ed0e4..fa619fe7d3 100644 --- a/.github/workflows/mergify-labels-copier.yml +++ b/.github/workflows/mergify-labels-copier.yml @@ -13,11 +13,13 @@ jobs: runs-on: ubuntu-latest if: startsWith(github.head_ref, 'mergify/bp/') permissions: - # Add GH labels - pull-requests: write - # See https://github.com/cli/cli/issues/6274 - repository-projects: read + id-token: write steps: - - uses: elastic/oblt-actions/mergify/labels-copier@v1 + - name: Create ephemeral GitHub token + id: create-token + uses: elastic/oblt-actions/github/create-token@v1 + - name: Copy parent labels to backport + uses: elastic/oblt-actions/mergify/labels-copier@v1 with: excluded-labels-regex: "^backport-*" + github-token: ${{ steps.create-token.outputs.token }} From 503128700f0caac1c73ae83f82f0b6c5d56ba604 Mon Sep 17 00:00:00 2001 From: "fr4nc1sc0.r4m0n" Date: Tue, 27 Oct 2026 10:29:36 +0100 Subject: [PATCH 2/3] Use use-ephemeral-token for Mergify labels copier. Mint inside labels-copier instead of a separate create-token step. --- .github/workflows/mergify-labels-copier.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/mergify-labels-copier.yml b/.github/workflows/mergify-labels-copier.yml index fa619fe7d3..46c1a45585 100644 --- a/.github/workflows/mergify-labels-copier.yml +++ b/.github/workflows/mergify-labels-copier.yml @@ -13,13 +13,16 @@ jobs: runs-on: ubuntu-latest if: startsWith(github.head_ref, 'mergify/bp/') permissions: + # Add GH labels (GITHUB_TOKEN; Vault token scopes come from TokenPolicy) + pull-requests: write + # See https://github.com/cli/cli/issues/6274 + repository-projects: read + # OIDC for create-token (required when use-ephemeral-token is true) id-token: write steps: - - name: Create ephemeral GitHub token - id: create-token - uses: elastic/oblt-actions/github/create-token@v1 - name: Copy parent labels to backport uses: elastic/oblt-actions/mergify/labels-copier@v1 with: excluded-labels-regex: "^backport-*" - github-token: ${{ steps.create-token.outputs.token }} + use-ephemeral-token: true + From 6bbb5ce4215afa39b4a8e3ae81138e68779d2d24 Mon Sep 17 00:00:00 2001 From: "fr4nc1sc0.r4m0n" Date: Tue, 27 Oct 2026 11:21:31 +0100 Subject: [PATCH 3/3] Drop unused GITHUB_TOKEN job permissions from labels copier. Label writes use the Vault token from TokenPolicy; only id-token: write is needed for OIDC. --- .github/workflows/mergify-labels-copier.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/mergify-labels-copier.yml b/.github/workflows/mergify-labels-copier.yml index 46c1a45585..cdd8a546ab 100644 --- a/.github/workflows/mergify-labels-copier.yml +++ b/.github/workflows/mergify-labels-copier.yml @@ -13,10 +13,6 @@ jobs: runs-on: ubuntu-latest if: startsWith(github.head_ref, 'mergify/bp/') permissions: - # Add GH labels (GITHUB_TOKEN; Vault token scopes come from TokenPolicy) - pull-requests: write - # See https://github.com/cli/cli/issues/6274 - repository-projects: read # OIDC for create-token (required when use-ephemeral-token is true) id-token: write steps: