Compliance: allow_auto_merge #118

Activity

1. don-petry

   added

   claude

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   on May 11, 2026
2. donpetry-bot commented on May 11, 2026

   

   donpetry-bot

   on May 11, 2026

   Last edited by donpetry-bot

   Contributor

   More actions

   Claude finished @don-petry's task in 4m 14s —— View job

   ---

   Compliance Fix: allow_auto_merge

   • Check for existing PRs for this issue
   • Read standards documentation
   • Understand what needs to be changed
   • Verify fix status
   • Document findings

   Finding: Already Compliant

   After investigation, the repository's allow_auto_merge setting is already true:

   Setting	Current	Expected	Status
   allow_auto_merge	true	true	✅
   delete_branch_on_merge	true	true	✅
   has_wiki	false	false	✅
   has_issues	true	true	✅
   has_discussions	true	true	✅

   The dependabot-automerge.yml workflow is also present and matches the standard template verbatim.

   Root cause: The compliance audit token (ORG_SCORECARD_TOKEN) may have had insufficient permissions to read the allow_auto_merge field at audit time — GitHub only surfaces this field to tokens with push access. This would cause the audit to see null even when the setting is enabled.

   No code changes are required. The next weekly compliance audit should see the setting as true and auto-close this issue.

   @petry-projects/org-leads — please verify the ORG_SCORECARD_TOKEN used by the compliance audit has at least push access to org repos so allow_auto_merge reads correctly and avoids false-positive findings like this one.
3. don-petry

   closed this as completedon May 12, 2026