From 547ea28e97500e68cc89d38f7a1c7c61588167df Mon Sep 17 00:00:00 2001
From: dlrsp-dev <dlrsp.dev@gmail.com>
Date: Mon, 7 Sep 2026 00:55:52 +0200
Subject: [PATCH] fix(ci): soft-skip upgrade PR and auto-merge when unavailable

Skip Open Pull Request when App secrets are empty (private/template repos). Treat GraphQL auto-merge-disabled as a warning instead of failing the policy gate.
---
 .github/workflows/pr-policy-gate.yaml     | 12 +++++++++++-
 .github/workflows/upgrade-dependency.yaml | 15 +++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-policy-gate.yaml b/.github/workflows/pr-policy-gate.yaml
index f320bbab..e4fd2cab 100644
--- a/.github/workflows/pr-policy-gate.yaml
+++ b/.github/workflows/pr-policy-gate.yaml
@@ -137,7 +137,17 @@ jobs:
           && inputs.enable-auto-merge
           && github.event.pull_request.user.login != 'app/dlrsp-actions'
           && github.event.pull_request.user.login != 'dlrsp-actions[bot]'
-        run: gh pr merge --auto --rebase "${{ github.event.pull_request.html_url }}"
+        run: |
+          set -euo pipefail
+          if ! out="$(gh pr merge --auto --rebase "${{ github.event.pull_request.html_url }}" 2>&1)"; then
+            if [[ "$out" == *"Auto merge is not allowed"* ]] || [[ "$out" == *"enablePullRequestAutoMerge"* ]]; then
+              echo "::warning::Auto-merge not enabled on this repository — skipping"
+              exit 0
+            fi
+            echo "$out"
+            exit 1
+          fi
+          echo "$out"
         env:
           GH_TOKEN: ${{ steps.dlrsp-token.outputs.token }}
 
diff --git a/.github/workflows/upgrade-dependency.yaml b/.github/workflows/upgrade-dependency.yaml
index a3f35613..eac44f4b 100644
--- a/.github/workflows/upgrade-dependency.yaml
+++ b/.github/workflows/upgrade-dependency.yaml
@@ -116,7 +116,21 @@ jobs:
           pattern: py*
           merge-multiple: true
 
+      # Private/template repos may lack org App secrets; skip PR rather than fail schedule.
+      - name: Check App secrets available
+        id: app-secrets
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -z "${{ secrets.DLRSP_ACTIONS_APP_ID }}" || -z "${{ secrets.DLRSP_ACTIONS_PRIVATE_KEY }}" ]]; then
+            echo "::warning::App secrets unavailable in this repository — skipping Open Pull Request"
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Create App installation token
+        if: steps.app-secrets.outputs.available == 'true'
         id: dlrsp-token
         uses: DLRSP/workflows/.github/actions/dlrsp-actions-token@main
         with:
@@ -126,6 +140,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Create Pull Request
+        if: steps.app-secrets.outputs.available == 'true'
         id: cpr
         uses: peter-evans/create-pull-request@v8
         with: