[deathanatos]

It looks like default branch was force-pushed to the last commit on the branch of the PR? If you have permission to push … that's not "unauthorized"?

That a PR gets "merged" if the base branch becomes equal with the PR's last commit is … a bit weird, but it makes perfect sense in cases like where one might want to FF the base to keep things clean. The force-push muddles it a bit. Surprising to new users, maybe, but "unauthorized" seems like a stretch unless I'm missing something.

There are cases where I think Github's controls could be much clearer. E.g., in some cases, you can "require" reviews, yet still change the branch after the approval. So once you have approval … it's like carte blanche to merge whatever. It is sometimes useful — if the repo is not security critical, and you trust your reviewee, it lets me say "these three changes please, then LGTM", approve it, and just trust they'll do the right thing. But if you need tight controls, then not so much. There's also Github Actions & required checks … if a "required check" is skipped, Github treats that as if the check passed! (That, to me, is a bug. To Github's support reps … that's just how it works.)

[Arnavion]

>It looks like default branch was force-pushed to the last commit on the branch of the PR? If you have permission to push … that's not "unauthorized"?

No, other way around. upstream was originally at 61f3741 . PR was at a31b8dd which was a commit on top of 61f3741 . Then they force-pushed the PR to 61f3741 . It's still not a problem because it's just the PR branch that was modified. And as OP says elsewhere in this thread, it's definitely confusing to mark it as "Merged" even though it's technically correct.