From fb4c58c3134dd16a48717371a749b49ce6ca0eca Mon Sep 17 00:00:00 2001
From: seth <getchoo@tuta.io>
Date: Fri, 13 Oct 2023 11:23:07 -0400
Subject: actions: use GH_TOKEN for gh & scope permissions to jobs

---
 .github/workflows/autobot.yaml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

(limited to '.github/workflows/autobot.yaml')

diff --git a/.github/workflows/autobot.yaml b/.github/workflows/autobot.yaml
index 9dc8df3..792158a 100644
--- a/.github/workflows/autobot.yaml
+++ b/.github/workflows/autobot.yaml
@@ -2,14 +2,16 @@ name: auto-merge dependabot
 
 on: pull_request
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   automerge:
     runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+
     if: github.actor == 'dependabot[bot]'
+
     steps:
       - uses: dependabot/fetch-metadata@v1
         id: metadata
@@ -21,4 +23,4 @@ jobs:
         run: gh pr merge --auto --rebase "$PR"
         env:
           PR: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ secrets.MERGE_TOKEN }}
+          GH_TOKEN: ${{ secrets.MERGE_TOKEN }}
-- 
cgit v1.2.3