ci: auto-merge dependabot patch bumps for dev and transitive deps (#4915) - #4916
Open
NoopDog wants to merge 1 commit into
Open
ci: auto-merge dependabot patch bumps for dev and transitive deps (#4915)#4916NoopDog wants to merge 1 commit into
NoopDog wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4915.
Adds a
dependabot-auto-mergeworkflow. For PRs authored bydependabot[bot], it reads update metadata viadependabot/fetch-metadata(SHA-pinned, matching this repo's convention) and, only when the bump is patch-level (version-update:semver-patch) and the dependency is dev-only (direct:development) or transitive (indirect), approves the PR and enables GitHub auto-merge with squash.Everything else — runtime (
direct:production) dependencies and any minor/major bump — is untouched and stays on manual review.Rationale: these PRs (e.g. #4904) are lockfile-only, never ship to production, and cannot change any API the app codes against; CI is the only meaningful gate.
Accompanying repo settings (admin, done outside this PR)
gh pr merge --autofails without it).buildadded as a required status check onmain(there were previously none, so auto-merge would have merged before CI completed).mainalready required 1 approving review; the workflow's approval satisfies that for matching Dependabot PRs.Known caveat
Merges completed via the workflow's
GITHUB_TOKENdo not triggerpush-event workflows, sorelease-pleasewill not run on these merges. Nothing is lost — it picks up thechore(deps)commits on the next push tomain(or viaworkflow_dispatch).🤖 Generated with Claude Code