From 1bc12a7ef4a7469ccdef1c4483406eeba92ef670 Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 11:40:33 -0500 Subject: [PATCH] ci(deps): auto-merge dependabot bumps via the org reusable workflow sphragis received its first dependabot config today and immediately had six update PRs open, none of which merge themselves. This adds the auto-merger. A sixteen-line caller rather than a copy of the workflow body. forkwright/.github owns the implementation, theatron already consumes it this way, and the logic worth not duplicating is substantial: it polls for check GROUPS to appear rather than calling `gh pr checks --watch`, because --watch returns as soon as the fast checks report and would approve a PR whose gate had not started. Adopted here and NOT in koinon, epitelesis, logismos, dioptron or typikon, which also gained dependabot configs today. The workflow waits on four check groups -- gate, cargo deny, cargo audit, osv -- and FAILS when a group never reports, which is deliberate: a verification check that goes missing is the case it exists to catch. Measured against live PRs, sphragis is the only one of the six that reports all four. koinon has neither cargo audit nor osv; epitelesis and logismos have no osv; dioptron and typikon have no security workflow at all. Copying this file into those repos would not give them auto-merge, it would give them a job that times out and reports failure on every dependabot PR. The gap to close there is security scanning, not this workflow. Pinned at d5685976, the current tip. Deliberately NOT theatron's 54f1af7c, which predates the normalised check-name matching -- that older revision compared exact suffixes and could not match `osv scanner / osv-scan` against `osv-scan` in several repos. --- .github/workflows/dependabot-auto-merge.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..2cca91b --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,16 @@ +name: Dependabot Auto-Merge + +on: + pull_request: + +permissions: + contents: write + pull-requests: write + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + dependabot-auto-merge: + uses: forkwright/.github/.github/workflows/dependabot-auto-merge.yml@d5685976eaf7c40f4aede2a7893408ee1a152201