Repository navigation
Add Dependabot auto-merge workflow - #175
Conversation
Adds a GitHub Actions workflow to force rebase Dependabot PRs.
There was a problem hiding this comment.
Pull request overview
This PR adds a GitHub Actions workflow to automatically merge Dependabot pull requests. The workflow is configured to auto-merge minor dependency updates using squash merge.
Key Changes
- New workflow file that triggers on Dependabot PRs (opened, synchronized, reopened)
- Uses the
fastify/github-action-merge-dependabot@v3action to handle automatic merging - Configured to squash merge PRs for minor version updates
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| merge-method: squash | ||
| target: minor |
There was a problem hiding this comment.
The workflow will auto-merge Dependabot PRs without waiting for CI checks to pass. This is risky because it could merge broken code if tests fail. The workflow should include a check to ensure the CI workflow completes successfully before merging. Consider adding a dependency on the CI job status or using the action's approve-only option with GitHub's built-in auto-merge that waits for status checks.
| target: minor | |
| target: minor | |
| approve-only: true |
| auto-merge: | ||
| runs-on: ubuntu-latest | ||
| if: github.actor == 'dependabot[bot]' | ||
| steps: | ||
| - name: Auto merge Dependabot PRs | ||
| uses: fastify/github-action-merge-dependabot@v3 | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| merge-method: squash | ||
| target: minor |
There was a problem hiding this comment.
The target: minor setting will only auto-merge minor and patch updates. Given that Dependabot is configured to update both npm packages and GitHub Actions (see .github/dependabot.yml), this configuration may not be appropriate for GitHub Actions updates which follow different versioning patterns (e.g., v3, v4). Consider whether all update types should be auto-merged or if GitHub Actions should be handled separately.
| auto-merge: | |
| runs-on: ubuntu-latest | |
| if: github.actor == 'dependabot[bot]' | |
| steps: | |
| - name: Auto merge Dependabot PRs | |
| uses: fastify/github-action-merge-dependabot@v3 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| merge-method: squash | |
| target: minor | |
| auto-merge-npm: | |
| runs-on: ubuntu-latest | |
| if: github.actor == 'dependabot[bot]' && contains(github.event.pull_request.title, 'npm') | |
| steps: | |
| - name: Auto merge Dependabot npm PRs | |
| uses: fastify/github-action-merge-dependabot@v3 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| merge-method: squash | |
| target: minor | |
| auto-merge-actions: | |
| runs-on: ubuntu-latest | |
| if: github.actor == 'dependabot[bot]' && (contains(github.event.pull_request.title, 'github-actions') || contains(github.event.pull_request.title, 'actions/')) | |
| steps: | |
| - name: Auto merge Dependabot GitHub Actions PRs | |
| uses: fastify/github-action-merge-dependabot@v3 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| merge-method: squash | |
| target: all |
No description provided.