Integrating Flathub releases with my release pipeline

nukeop · April 8, 2026, 3:09pm

I have a release pipeline with multiple jobs releasing to e.g. Github Releases, AUR, or NPM.

Now I would like to integrate Flathub with the same pipeline. The manual process goes like this:

I push a tag, and build a new release
Then I manually update my Flathub repo with the new version and hash
I push to a branch, and open a PR
I wait ~10-15 minutes for the build to finish
I merge the PR manually

I can automate all of it up to the point where I wait for the PR build. How do you guys handle it and are there any recommended ways of handling that? I can’t think of anything better than a job that runs every 5 minutes and polls the repo for open PRs to merge, but obviously that’s ugly.

A major roadblock is that Github won’t let you receive webhooks from a repo you don’t have admin access to, so a true event-driven pipeline is off the table here.

ChristopherHX · April 11, 2026, 11:41am

Hi,

I did set up auto merge for flathub-beta a while ago

github.com/flathub/io.mrarm.mcpelauncher

.github/workflows/merge-nightly.yml

master

name: Merge Nightly

on:
  workflow_dispatch:
    inputs:
      pr-number:
        type: string
  issue_comment:
    types:
      - created

run-name: ${{ ((github.actor_id == '45397632' || github.actor_id == 45397632) && github.event.issue.pull_request != null && contains(github.event.issue.labels.*.name, 'beta-update') && contains(github.event.comment.body, 'flatpak install') || inputs.pr-number) && format('Auto Merge PR {0}', github.event.issue.number || inputs.pr-number) || 'Ignore Comment - Skip Automerge' }}

jobs:
  check-comment:
    if: (github.actor_id == '45397632' || github.actor_id == 45397632) && github.event.issue.pull_request != null && contains(github.event.issue.labels.*.name, 'beta-update') && contains(github.event.comment.body, 'flatpak install') || inputs.pr-number
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Perform action for "flatpak install" comment

This file has been truncated. show original

E.g.

I added a special label beta-update to the pr as a filter so only specific PRs get auto merged
Take care to not auto merge PRs from untrusted forks/users
Usually users from forks cannot freely decide about pr labels
This workflow checks the author of the done comment is done by flathub bots account id not anyone trying to fake that entity
The flathub bot comment is usually some minutes after the commit status, but good enough for full automation

I cannot say if this is good solution, but merging possible daily beta PRs by hand is not manageable.