From 9441d5258402a299b7279bca40cee2cde7e89c97 Mon Sep 17 00:00:00 2001
From: Doug Eubanks <doug@dougeubanks.com>
Date: Wed, 9 Sep 2026 22:36:19 -0400
Subject: [PATCH] ci: add Dependabot auto-merge workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Automatically merges Dependabot PRs for patch and minor version bumps
once all required CI checks pass. Major version bumps are excluded and
require manual review.

Uses dependabot/fetch-metadata to read the update type and gh pr merge
--auto to queue the merge — GitHub only executes the merge once every
required status check is green.

Also enabled "allow_auto_merge" on the repository via the GitHub API
(required for gh pr merge --auto to work).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PhSFmsQDhrUoFR7F8EHkD5
---
 .github/workflows/dependabot-auto-merge.yml | 37 +++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/dependabot-auto-merge.yml

diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..66e8599
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,37 @@
+name: Dependabot auto-merge
+
+# Automatically merges Dependabot PRs once all required CI checks pass.
+# Only patch and minor version bumps are auto-merged; major bumps require
+# manual review (breaking changes are too risky to merge unseen).
+#
+# Requires: repository Settings → General → "Allow auto-merge" must be on
+# (enabled via the GitHub API when this workflow was added).
+
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    name: Auto-merge Dependabot PRs
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for patch and minor updates
+        # Major version bumps need a human look — skip them here.
+        if: |
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}