From 74da657d9e6593f7420e94a6961f05f1f0c0033a Mon Sep 17 00:00:00 2001
From: John Ajera <j.ajera@gns.cri.nz>
Date: Fri, 14 Nov 2025 09:46:58 +1300
Subject: [PATCH] feat: enable auto image update

configures auto image updater
---
 .github/dependabot.yml           | 21 +++++++++++++++++++++
 .github/workflows/auto-merge.yml | 28 ++++++++++++++++++++++++++++
 Dockerfile                       |  7 ++-----
 README.md                        | 23 +++++++++++++++++++++--
 requirements.txt                 |  4 ++++
 5 files changed, 76 insertions(+), 7 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/auto-merge.yml
 create mode 100644 requirements.txt

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..98cdd2c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,21 @@
+version: 2
+updates:
+  # Monitor Docker base image
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+
+  # Monitor Python packages
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore"
+      include: "scope"
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
new file mode 100644
index 0000000..53a45d6
--- /dev/null
+++ b/.github/workflows/auto-merge.yml
@@ -0,0 +1,28 @@
+name: Auto-merge Dependabot PRs
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  check_suite:
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+  checks: read
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Enable auto-merge for Dependabot PRs
+        uses: fastify/github-action-merge-dependabot@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          target: main
+          merge-method: squash
+          merge-commit-message: pull-request-title
+          skip-if-mergeable: false
+          skip-if-checks-pending: true
+          skip-if-required-checks-pending: true
diff --git a/Dockerfile b/Dockerfile
index e6c82ac..7902deb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,11 +4,8 @@ FROM python:3.13-slim
 WORKDIR /docs
 
 # Install mkdocs and mkdocs-material
-RUN pip install --no-cache-dir \
-    mkdocs \
-    mkdocs-material \
-    mkdocs-minify-plugin \
-    mkdocs-redirects
+COPY requirements.txt /tmp/requirements.txt
+RUN pip install --no-cache-dir -r /tmp/requirements.txt
 
 # Expose the default mkdocs port
 EXPOSE 8000
diff --git a/README.md b/README.md
index 35004a3..d850b25 100644
--- a/README.md
+++ b/README.md
@@ -40,15 +40,34 @@ docker run -p 8000:8000 -v $(pwd)/test:/docs mkdocs-material-image:latest
 
 The GitHub Actions workflow builds and pushes the image to GHCR on push to main or when tags are created.
 
+### Automated Dependency Updates
+
+Dependabot automatically monitors and creates pull requests for:
+
+- **Docker base image** (`python:3.13-slim`) - checks weekly for security patches and updates
+- **Python packages** (`mkdocs`, `mkdocs-material`, etc.) - checks weekly for new versions
+
+**Fully Automated Process:**
+
+1. Dependabot creates PRs with commit messages following the conformance format (`chore(deps): ...`)
+2. CI workflow validates the build
+3. Commit message conformance check validates the PR
+4. Auto-merge workflow automatically merges PRs that pass all checks
+5. Merging triggers the build-and-release workflow to build and push the new image
+
+No manual intervention required - the entire update process is automated.
+
 ## Project Structure
 
 ```plaintext
 .
 ├── Dockerfile                 # Docker image definition
+├── requirements.txt          # Python package dependencies
 ├── .dockerignore             # Files excluded from Docker build
 ├── .github/
-│   └── workflows/
-│       └── build-and-release.yml  # CI/CD workflow
+│   ├── workflows/
+│   │   └── build-and-release.yml  # CI/CD workflow
+│   └── dependabot.yml        # Automated dependency updates
 ├── .vscode/
 │   ├── settings.json         # VS Code settings
 │   └── extensions.json       # Recommended extensions
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..cd7bf84
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,4 @@
+mkdocs
+mkdocs-material
+mkdocs-minify-plugin
+mkdocs-redirects