Chore: [AEA-0000] - add dependabot approve schedule#19
Conversation
There was a problem hiding this comment.
Pull request overview
Adds a scheduled GitHub Actions workflow to automatically approve/enable auto-merge for Dependabot updates, and adjusts the existing PR workflow accordingly.
Changes:
- Removed the Dependabot auto-approve/merge reusable-workflow job from the PR workflow.
- Added a new scheduled workflow (
auto_approve_dependabot.yml) that runs an auto-approve/auto-merge action on a cron cadence. - Reformatted the existing PR workflow YAML.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/pull_request.yml | Removes Dependabot auto-approve/merge job and reformats workflow structure. |
| .github/workflows/auto_approve_dependabot.yml | Introduces a scheduled workflow to auto-approve/enable auto-merge for dependency update PRs. |
| name: pull_request | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: [ main ] | ||
| pull_request: | ||
| branches: [main] | ||
| permissions: {} |
There was a problem hiding this comment.
The indentation/formatting in this workflow (2-space nesting, [main]) is inconsistent with other workflows in this repo (e.g., .github/workflows/ci.yml and release.yml use 4-space nesting and [ main ]). Consider keeping formatting consistent to reduce noisy diffs and make workflows easier to scan side-by-side.
| name: Auto-approve dependency updates | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| schedule: | ||
| - cron: '*/30 * * * *' | ||
|
|
There was a problem hiding this comment.
The PR title/description says "add Dependabot schedule", but the repo already has scheduled Dependabot updates in .github/dependabot.yml. This workflow instead schedules an auto-approve/auto-merge job; please update the PR title/description to match the actual change (or clarify what schedule is being added).
| on: | ||
| workflow_dispatch: | ||
| schedule: | ||
| - cron: '*/30 * * * *' |
There was a problem hiding this comment.
The scheduled trigger runs every 30 minutes, which will consume runner minutes and GitHub API calls even when there are no Dependabot PRs to approve. Consider reducing the cadence (e.g., hourly/daily) or adding logic to skip quickly when there is nothing to do, to avoid unnecessary operational load.
| - cron: '*/30 * * * *' | |
| - cron: '0 * * * *' |
anthony-nhs
changed the title
Add Dependabot schedule to the repository