From 6f71395cf626fc9540fcc261c3b89ae7d7b871fa Mon Sep 17 00:00:00 2001 From: Russ Rutledge Date: Mon, 7 Sep 2026 21:45:59 -0500 Subject: [PATCH] ci: auto-merge patch and minor Dependabot updates Adds a workflow that approves Dependabot PRs and enables GitHub's native auto-merge for patch and minor version updates, so they merge on their own once branch protection is satisfied. Major updates still open a normal PR for review. This is inert until a maintainer enables "Allow auto-merge" on the repo and requires the CI checks on the main branch, so auto-merge waits for green before merging. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01EqiXti3H1onRAb3esyV1Dg --- .github/workflows/dependabot-auto-merge.yml | 33 +++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 00000000..9998eb55 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,33 @@ +name: Dependabot auto-merge + +# Auto-approve and enable auto-merge for Dependabot dependency updates, so GitHub +# merges them on its own once branch protection is satisfied. GitHub merges only +# after every required status check on `main` passes, so this is safe ONLY once the +# repo requires its CI checks on the branch (see the PR that adds this file). Scoped +# to patch and minor updates; major updates still open a normal PR for human review. + +on: pull_request + +permissions: + contents: write + pull-requests: write + +jobs: + dependabot-auto-merge: + runs-on: ubuntu-latest + if: github.event.pull_request.user.login == 'dependabot[bot]' + steps: + - name: Fetch Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v2 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Approve and enable auto-merge for patch and minor updates + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: | + gh pr review --approve "$PR_URL" + gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}