.github/workflows/flake-update.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: nix
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - run: nix flake update -L
 

ci.py

@@ -481,10 +481,10 @@ def open_pr(args):
     if push.returncode != 0:
         raise RuntimeError(f"git push failed:\n{push.stderr}")
 
-    owner = os.environ["REPO"].split("/")[0]
+    pulls = gitea("GET", "/pulls?state=open")
-    existing = gitea("GET", f"/pulls?state=open&head={owner}:{args.branch}")
+    existing = next((pr for pr in pulls if pr["head"]["ref"] == args.branch), None)
     if existing:
-        print(f"PR #{existing[0]['number']} already open, pushed update")
+        print(f"PR #{existing['number']} already open, pushed update")
         return
     labels = [label_id(args.label)] if args.label else []
     pr = gitea("POST", "/pulls",