feat(platform/github): flag to control whether PRs can be edited by maintainers if forkTokenis set

docs/usage/configuration-options.md

@@ -875,6 +875,16 @@ Renovate follows tags _strictly_, this can cause problems when a tagged stream i
 For example: you're following the `next` tag, but later the stream you actually want is called `stable` instead.
 If `next` is no longer getting updates, you must switch your `followTag` to `stable` to get updates again.
 
+## forkModeAllowMaintainerEdits
+
+Use `forkModeAllowMaintainerEdits` to control if maintainers can edit Renovate's pull requests when in fork mode.
+
+This allows project maintainers to make manual changes to the Renovate PR branch, without needing to create another new PR.
+
+<!-- prettier-ignore -->
+!!! note
+    This option is only relevant if you set `forkToken`.
+
 ## gitAuthor
 
 You can customize the Git author that's used whenever Renovate creates a commit.

lib/config/options/index.ts

@@ -1913,6 +1913,14 @@ const options: RenovateOptions[] = [
     default: false,
     supportedPlatforms: ['gitlab'],
   },
+  {
+    name: 'forkModeAllowMaintainerEdits',
+    description:
+      'Decides if maintainers can edit Renovate pull requests when running in fork mode.',
+    type: 'boolean',
+    supportedPlatforms: ['github'],
+    default: true,
+  },
   {
     name: 'confidential',
     description:

lib/config/types.ts

@@ -230,6 +230,7 @@ export interface RenovateConfig
   postUpdateOptions?: string[];
   prConcurrentLimit?: number;
   prHourlyLimit?: number;
+  forkModeAllowMaintainerEdits?: boolean;
 
   defaultRegistryUrls?: string[];
   registryUrls?: string[] | null;

lib/modules/platform/github/index.spec.ts

@@ -275,7 +275,7 @@ describe('modules/platform/github/index', () => {
     repository: string,
     forkExisted: boolean,
     forkResult = 200,
-    forkDefaulBranch = 'master'
+    forkDefaultBranch = 'master'
   ): void {
     scope
       // repo info
@@ -308,7 +308,7 @@ describe('modules/platform/github/index', () => {
               {
                 full_name: 'forked/repo',
                 owner: { login: 'forked' },
-                default_branch: forkDefaulBranch,
+                default_branch: forkDefaultBranch,
               },
             ]
           : []
@@ -2181,6 +2181,92 @@ describe('modules/platform/github/index', () => {
       expect(pr).toMatchObject({ number: 123 });
     });
 
+    describe('with forkToken', () => {
+      let scope: httpMock.Scope;
+
+      beforeEach(async () => {
+        scope = httpMock.scope(githubApiHost);
+        forkInitRepoMock(scope, 'some/repo', false);
+        scope.get('/user').reply(200, {
+          login: 'forked',
+        });
+        scope.post('/repos/some/repo/forks').reply(200, {
+          full_name: 'forked/repo',
+          default_branch: 'master',
+        });
+
+        await github.initRepo({
+          repository: 'some/repo',
+          forkToken: 'true',
+        });
+      });
+
+      it('should allow maintainer edits if enabled via options', async () => {
+        scope
+          .post(
+            '/repos/some/repo/pulls',
+            // Ensure the `maintainer_can_modify` option is set in the REST API request.
+            (body) => body.maintainer_can_modify === true
+          )
+          .reply(200, {
+            number: 123,
+            head: { repo: { full_name: 'some/repo' }, ref: 'some-branch' },
+          });
+        const pr = await github.createPr({
+          sourceBranch: 'some-branch',
+          targetBranch: 'main',
+          prTitle: 'PR title',
+          prBody: 'PR can be edited by maintainers.',
+          labels: null,
+          forkModeAllowMaintainerEdits: true,
+        });
+        expect(pr).toMatchObject({ number: 123 });
+      });
+
+      it('should not allow maintainer edits if not explicitly set', async () => {
+        scope
+          .post(
+            '/repos/some/repo/pulls',
+            // Ensure the `maintainer_can_modify` option is `false` in the REST API request.
+            (body) => body.maintainer_can_modify === false
+          )
+          .reply(200, {
+            number: 123,
+            head: { repo: { full_name: 'some/repo' }, ref: 'some-branch' },
+          });
+        const pr = await github.createPr({
+          sourceBranch: 'some-branch',
+          targetBranch: 'main',
+          prTitle: 'PR title',
+          prBody: 'PR *cannot* be edited by maintainers.',
+          labels: null,
+        });
+        expect(pr).toMatchObject({ number: 123 });
+      });
+
+      it('should not allow maintainer edits if explicitly disabled', async () => {
+        scope
+          .post(
+            '/repos/some/repo/pulls',
+            // Ensure the `maintainer_can_modify` option is `false` in the REST API request.
+            (body) => body.maintainer_can_modify === false
+          )
+          .reply(200, {
+            number: 123,
+            head: { repo: { full_name: 'some/repo' }, ref: 'some-branch' },
+          });
+        const pr = await github.createPr({
+          sourceBranch: 'some-branch',
+          targetBranch: 'main',
+          prTitle: 'PR title',
+          prBody: 'PR *cannot* be edited by maintainers.',
+          labels: null,
+          forkModeAllowMaintainerEdits: false,
+        });
+        expect(pr).toMatchObject({ number: 123 });
+      });
+    });
+
     describe('automerge', () => {
       const createdPrResp = {
         number: 123,

lib/modules/platform/github/index.ts

@@ -1479,6 +1479,7 @@ export async function createPr({
   prBody: rawBody,
   labels,
   draftPR = false,
+  forkModeAllowMaintainerEdits,
   platformOptions,
 }: CreatePRConfig): Promise<GhPr | null> {
   const body = sanitize(rawBody);
@@ -1499,7 +1500,7 @@ export async function createPr({
   // istanbul ignore if
   if (config.forkToken) {
     options.token = config.forkToken;
-    options.body.maintainer_can_modify = true;
+    options.body.maintainer_can_modify = !!forkModeAllowMaintainerEdits;
   }
   logger.debug({ title, head, base, draft: draftPR }, 'Creating PR');
   const ghPr = (

lib/modules/platform/types.ts

@@ -103,6 +103,7 @@ export interface CreatePRConfig {
   labels?: string[] | null;
   platformOptions?: PlatformPrOptions;
   draftPR?: boolean;
+  forkModeAllowMaintainerEdits?: boolean;
 }
 export interface UpdatePrConfig {
   number: number;

lib/workers/repository/config-migration/pr/index.ts

@@ -100,6 +100,7 @@ ${
         sourceBranch: branchName,
         // TODO #7154
         targetBranch: config.defaultBranch!,
+        forkModeAllowMaintainerEdits: config.forkModeAllowMaintainerEdits,
         prTitle,
         prBody,
         labels,

lib/workers/repository/onboarding/pr/index.ts

@@ -174,6 +174,7 @@ If you need any further assistance then you can also [request help here](${
       const pr = await platform.createPr({
         sourceBranch: config.onboardingBranch!,
         targetBranch: config.defaultBranch!,
+        forkModeAllowMaintainerEdits: config.forkModeAllowMaintainerEdits,
         prTitle: config.onboardingPrTitle!,
         prBody,
         labels,

lib/workers/repository/update/pr/index.ts

@@ -353,6 +353,7 @@ export async function ensurePr(
           labels: prepareLabels(config),
           platformOptions: getPlatformPrOptions(config),
           draftPR: config.draftPR,
+          forkModeAllowMaintainerEdits: config.forkModeAllowMaintainerEdits,
         });
 
         incLimitedValue('PullRequests');