Auto-merge Dependabot security PRs for patch/minor bumps - #7
Merged
Conversation
Handles the merge step Dependabot's security updates leave to a human: once it opens a PR for a vulnerability fixed by a version bump, this approves and enables auto-merge -- but only for patch/minor semver bumps, and only once every existing CI check (.github/workflows/ci.yml) is green. Major bumps (see PR #5, maplibre-gl 5.x->6.x, currently failing CI) are deliberately left for a human. Requires the repo's "Allow auto-merge" setting (Settings > General > Pull Requests), which is currently off and could not be flipped via the API -- needs an org owner to enable it by hand. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Dependabot security updates are already enabled and working (24/26 past alerts fixed via PRs it opened itself). What's missing is the merge step — every one of those PRs still needed a human to click merge.
This adds a workflow that auto-approves and enables auto-merge for a Dependabot PR, but only when:
maplibre-gl5.x→6.x, currently failing CI — is left alone on purpose).github/workflows/ci.yml) — this workflow enables GitHub's native auto-merge, it does not bypass or replace CIdependabot[bot]Before this merges
The repo's "Allow auto-merge" setting (Settings → General → Pull Requests) is currently off, and I could not flip it via the API (likely an org-level restriction, not something the token's permissions could override) — an org owner needs to turn it on for
gh pr merge --autoto take effect. Until then this workflow approves the PR but the merge itself just waits.Already done, not part of this PR
PR #6 (
smol-toml, High severity, patch bump, CI fully green) was merged directly while investigating this — closing Dependabot alert #26.🤖 Generated with Claude Code