From 5c2b3e6ab3a14806d8ee327713ec00207a53657a Mon Sep 17 00:00:00 2001 From: Jeff West Date: Sun, 17 May 2026 15:08:17 -0500 Subject: [PATCH] ci: auto-merge Dependabot patch/minor PRs Adds a workflow that auto-enables squash-merge on Dependabot PRs when the update is patch or minor. Major updates are left for human review since they may introduce breaking changes. Mechanics: - Triggers on pull_request events from dependabot[bot] only. - Uses dependabot/fetch-metadata (SHA-pinned to v2.4.0) to extract update-type from the PR title/body. - Calls `gh pr merge --auto --squash`, which queues the merge to fire once required status checks (test 3.12 / test 3.13 / drift-check) pass. If a check fails, the PR is not merged. No approval step is needed: branch protection on main has no required reviewers (solo-maintainer repo), only required status checks. Permissions: contents: write + pull-requests: write are the minimum needed for `gh pr merge --auto`. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/dependabot-auto-merge.yml | 32 +++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..3c36bfc --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,32 @@ +name: Dependabot auto-merge + +# Auto-enable squash-merge on Dependabot PRs for patch and minor updates. +# Major bumps are left for human review (potential breaking changes). +# +# Auto-merge waits for the required status checks defined in branch +# protection (test 3.12 / test 3.13 / drift-check); GitHub will not +# merge until they pass. + +on: pull_request + +permissions: + contents: write + pull-requests: write + +jobs: + auto-merge: + if: github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - name: Fetch Dependabot metadata + id: meta + uses: dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b # v2.4.0 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto-merge for patch / minor updates + if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor' + run: gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}