Auto-approve and merge non-major Dependabot PRs - #53
Conversation
Branch protection requires reviews, so enabling auto-merge alone left Dependabot PRs blocked. Restore approval, keep major updates for human review, and match on the PR author so branch updates still trigger. Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 0a13c4a. Configure here.
| run: gh pr merge --auto --squash "$PR" | ||
|
|
||
| - name: Approve pull request | ||
| if: steps.meta.outputs.update-type != 'version-update:semver-major' |
There was a problem hiding this comment.
Branch updates auto-merge major PRs
High Severity
The job now runs on human-triggered branch updates, but dependabot/fetch-metadata by default requires every commit to come from dependabot[bot]. An Update branch merge commit fails that check, so update-type stays empty. The != version-update:semver-major conditions then treat the PR as eligible and can approve and auto-merge a major update that was meant for human review.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 0a13c4a. Configure here.
After a human branch update, fetch-metadata can leave update-type empty if commit verification fails, and != semver-major would still approve. Skip commit verification for merge commits, and only auto-approve/merge explicit minor or patch updates. Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
|
cursor review |
Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
1 participant
Summary
Dependabot PRs were enabling auto-merge but staying
BLOCKEDwithREVIEW_REQUIREDbecause branch protection needs an approving review.This updates
dependabot-auto-mergeto:dependabot[bot]) instead ofgithub.actor, so branch updates still trigger the workflowBugbot follow-up
Fail closed when
update-typeis empty/unknown (can happen after human branch updates if commit verification fails). Useskip-commit-verificationso metadata still parses after merge commits, and only auto-approve/merge explicitsemver-minor/semver-patchupdates.Repo setting to confirm
Settings → Actions → General → Allow GitHub Actions to create and approve pull requests must be enabled, or the approve step will fail.
After merge
Update open Dependabot PR branches (or
@dependabot rebase) so they re-run against the new workflow onmain.Slack Thread