Skip to content

feat(ci): add Dependabot + safe automerge for GitHub Actions #168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jbdevprimary merged 2 commits into from
Jul 27, 2026
+43 −2
Merged

feat(ci): add Dependabot + safe automerge for GitHub Actions #168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78f10bc
ci: bump actions/checkout to v7.0.1
jbdevprimary Jul 27, 2026
ab4bf84
feat(ci): add Dependabot + safe automerge for GitHub Actions
jbdevprimary Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
groups:
github-actions:
patterns:
- "*"
commit-message:
prefix: ci
29 changes: 29 additions & 0 deletions .github/workflows/automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: Automerge

on:
pull_request_target:

@amazon-q-developer amazon-q-developer Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Security Vulnerability: Using pull_request_target with write permissions creates a privilege escalation risk. This trigger runs workflows in the context of the base repository with access to secrets, even for PRs from forks. While the if: github.actor == 'dependabot[bot]' check provides some mitigation, a compromised Dependabot action or a race condition could still allow malicious code execution with write access to the repository.1

Switch to the pull_request trigger instead. The workflow will still have access to GITHUB_TOKEN with sufficient permissions for Dependabot PRs since Dependabot PRs originate from the same repository, not external forks.

Suggested change
pull_request_target:
pull_request:

Footnotes

  1. CWE-669: Incorrect Resource Transfer Between Spheres - https://cwe.mitre.org/data/definitions/669.html ↩

branches: [main]

permissions:
contents: write
pull-requests: write

jobs:
dependabot:
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- name: Fetch Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Approve and enable auto-merge (patch/minor only)
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use a token that lets the merge trigger CD

GH_TOKEN is the token gh uses for API authentication (CLI environment documentation), and GitHub suppresses workflow runs caused by the repository GITHUB_TOKEN except for dispatch events (GitHub token documentation). Since .github/workflows/cd.yml deploys only on a push to main, a Dependabot PR auto-merged with this token will not start CD, so that main commit is never deployed. Authenticate the merge with a PAT or GitHub App token, as the repository's prior automerge workflow did, or explicitly run deployment through the same workflow.

Useful? React with 👍 / 👎.

PR_URL: ${{ github.event.pull_request.html_url }}
run: |
gh pr review "$PR_URL" --approve

@amazon-q-developer amazon-q-developer Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛑 Logic Error: The workflow will fail when attempting to auto-approve Dependabot PRs. GitHub Actions does not allow a workflow run triggered by GITHUB_TOKEN to approve its own PR - this creates a circular dependency that GitHub explicitly blocks to prevent automation abuse.1

Add a dedicated bot token with PR approval permissions to secrets (e.g., DEPENDABOT_AUTO_MERGE_TOKEN), or remove the approval step and rely solely on branch protection rules requiring reviews from CODEOWNERS.

Footnotes

  1. CWE-670: Always-Incorrect Control Flow Implementation - https://cwe.mitre.org/data/definitions/670.html ↩

gh pr merge "$PR_URL" --squash --auto
2 changes: 1 addition & 1 deletion .github/workflows/cd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
url: ${{ steps.deployment.outputs.page_url }}
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Configure Pages
uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: Assert no Node build pipeline
run: |
Expand Down