Pull requests

On this page

Two ways to get one
Ready or draft
What gets bumped
When pull requests are replaced or closed
When there is no pull request
Permissions

Stackpaw can open a pull request per tool and release, with the version bumped and the issue's checklist attached. Automatically with auto_pr: true, or one at a time with /stackpaw pr.

Two ways to get one#

Automatically: set auto_pr: true in .stackat.yml, for one repository or the whole organisation. Each scan opens the pull requests that are due.
On request: reply /stackpaw pr on a Stackat issue. It works even with automatic pull requests off, and Stackat answers with the link or the reason it could not open one. Who may ask can be limited with commands.

Automatic pull requests are off by default: you get issues until you turn them on.

Ready or draft#

Verdict on the issue	Pull request
Safe to upgrade	Ready for review: nothing in the release notes touches your repository.
Review, Edits needed or Migration	Draft with the bump and the issue's checklist, to finish on the branch and then mark ready.

Every pull request:

bumps every pin of the tool in the repository to the target release, in one commit, on a branch named stackat/<tool>-<version>;
says Fixes #<issue>, so merging it closes the issue;
targets the same release as the issue, so a cooldown applies to it too.

What gets bumped#

Helm charts in helmfile, Argo CD, Flux and Kustomize: the chart version.
Container images: the tag, when the registry confirms the new tag exists.
Terraform providers: the version constraint in required_providers where it no longer allows the new release, and .terraform.lock.hcl, written from the checksums the Terraform registry publishes. Stackat does not run Terraform; terraform init adds your own platform's hash the next time it runs.

When a pin cannot be changed safely (the version is not written literally, say), no pull request is opened and /stackpaw pr answers with the reason.

When pull requests are replaced or closed#

A newer release replaces an open pull request for the same tool.
When the tool is already up to date (often because this pull request or another one was merged), Stackat closes its open pull request.
A pull request a person closed is not reopened on its own. Reply /stackpaw pr on the issue to get it again.

When there is no pull request#

/stackpaw pr always gets an answer. The common ones:

Situation	Answer
Your organisation installed Stackpaw Audit	Audit never changes code, so it cannot open pull requests. An admin can install Stackpaw instead.
The free plan	"Pull requests come with Stackat Team." An admin can upgrade on the dashboard. See Plans and billing.
The installation has not accepted the app's permission to change code yet	Ask an admin of your account to accept the new permissions, then reply `/stackpaw pr` again.
A pull request for this release is already open	"A pull request for this release is open already: #42."
Some releases in between are still being read	Reply again in an hour or two.
The tool is up to date here, or the issue is held back for review by the Stackat team	"Nothing to open a pull request for."

Permissions#

Pull requests need the Stackpaw app's Contents: read and write and Pull requests: read and write permissions, on the repositories you selected. Stackpaw Audit asks for neither. See Security and data.