From 4c7e663b100180c1a884b2b7570eb7dfdc12403b Mon Sep 17 00:00:00 2001
From: Cristian Curaba <cristiancuraba00@gmail.com>
Date: Fri, 11 Sep 2026 10:19:08 +0200
Subject: [PATCH] Auto-merge Dependabot security PRs for patch/minor bumps

Handles the merge step Dependabot's security updates leave to a human:
once it opens a PR for a vulnerability fixed by a version bump, this
approves and enables auto-merge -- but only for patch/minor semver
bumps, and only once every existing CI check (.github/workflows/ci.yml)
is green. Major bumps (see PR #5, maplibre-gl 5.x->6.x, currently
failing CI) are deliberately left for a human.

Requires the repo's "Allow auto-merge" setting (Settings > General >
Pull Requests), which is currently off and could not be flipped via
the API -- needs an org owner to enable it by hand.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/dependabot-auto-merge.yml | 50 +++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 .github/workflows/dependabot-auto-merge.yml

diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..582dc09
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,50 @@
+name: Dependabot auto-merge
+
+# Handles the part Dependabot's security updates don't do on their own: once it
+# has opened a PR for a vulnerability fixable by a version bump, someone still
+# has to click merge. This does that — but only for the safe case.
+#
+# Scope, deliberately narrow:
+#   - patch or minor semver bumps only. A major bump (e.g. a mapping library
+#     5.x -> 6.x) can break the app in ways CI's type-check and build catch but
+#     a human should still read — see PR #5 (maplibre-gl), which this workflow
+#     would correctly leave alone.
+#   - every job in ci.yml (.github/workflows/ci.yml) must already be green —
+#     this workflow ENABLES auto-merge, it does not bypass CI. GitHub merges
+#     the PR itself only once the existing checks finish passing.
+#   - Dependabot PRs only (`github.actor == 'dependabot[bot]'`) — this workflow
+#     grants no privilege to anyone else's PR.
+#
+# Requires the repo's "Allow auto-merge" setting (Settings -> General -> Pull
+# Requests). It was off when this workflow was added and could not be flipped
+# via the API (likely an org-level restriction) — turn it on by hand once, or
+# `gh pr merge --auto` below will fail with a clear message naming the setting.
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Read the update metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Approve and enable auto-merge (patch/minor only)
+        if: |
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: |
+          gh pr review "$PR_URL" --approve -b "Auto-approved: ${{ steps.metadata.outputs.update-type }} bump of ${{ steps.metadata.outputs.dependency-names }}."
+          gh pr merge "$PR_URL" --auto --squash
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}