From 859212c6056a3a9eff1a09daf9b44e58202cc14b Mon Sep 17 00:00:00 2001 From: ld-ahartmann Date: Tue, 20 Oct 2026 10:42:18 -0400 Subject: [PATCH 1/3] chore(ci): enable auto-merge for Dependabot minor and patch updates --- .github/workflows/dependabot-auto-merge.yml | 30 +++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 000000000..2d30aa3e6 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,30 @@ +name: Dependabot auto-merge + +# pull_request_target gives this workflow a write token for Dependabot PRs. +# It never checks out PR code, so no untrusted code runs in this context. +on: pull_request_target + +permissions: + contents: write + pull-requests: write + +jobs: + dependabot: + name: Auto-merge minor and patch updates + runs-on: ubuntu-latest + if: github.event.pull_request.user.login == 'dependabot[bot]' + steps: + - name: Fetch Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + + - name: Approve and enable auto-merge + if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_URL: ${{ github.event.pull_request.html_url }} + run: | + if [ "$(gh pr view "$PR_URL" --json reviewDecision --jq .reviewDecision)" != "APPROVED" ]; then + gh pr review --approve "$PR_URL" + fi + gh pr merge --auto --squash "$PR_URL" From 5a6bdfbb70389c42cc3fa36e0bb2f14e0c9b91e9 Mon Sep 17 00:00:00 2001 From: ld-ahartmann Date: Tue, 20 Oct 2026 11:04:32 -0400 Subject: [PATCH 2/3] fix(ci): skip GitHub Actions updates in Dependabot auto-merge --- .github/workflows/dependabot-auto-merge.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 2d30aa3e6..67a374b30 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -18,8 +18,10 @@ jobs: id: metadata uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + # GitHub Actions updates are skipped: they edit workflow files, which + # GITHUB_TOKEN (no workflows permission) cannot merge. - name: Approve and enable auto-merge - if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch' + if: (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch') && steps.metadata.outputs.package-ecosystem != 'github-actions' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PR_URL: ${{ github.event.pull_request.html_url }} From db642aca61e6ebc9af03dc2c928d837bb9ab4859 Mon Sep 17 00:00:00 2001 From: ld-ahartmann Date: Tue, 20 Oct 2026 11:13:04 -0400 Subject: [PATCH 3/3] fix(ci): use github_actions ecosystem name in auto-merge skip --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 67a374b30..fed182e42 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -21,7 +21,7 @@ jobs: # GitHub Actions updates are skipped: they edit workflow files, which # GITHUB_TOKEN (no workflows permission) cannot merge. - name: Approve and enable auto-merge - if: (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch') && steps.metadata.outputs.package-ecosystem != 'github-actions' + if: (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch') && steps.metadata.outputs.package-ecosystem != 'github_actions' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PR_URL: ${{ github.event.pull_request.html_url }}