From 22325b1d6f2bd5ac8890e70b6f38037aa94334b3 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Apr 2026 11:49:41 +0000
Subject: [PATCH 1/3] Add workflow to auto-merge Dependabot PRs

Uses pull_request_target to get write permissions without exposing
secrets to PR code (no checkout step). Approves the PR and enables
GitHub auto-merge, which waits for all required status checks to
pass before merging.

https://claude.ai/code/session_01UWiK5bH6Be6vft43zVVNbH
---
 .github/workflows/auto-merge-dependabot.yml | 23 +++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .github/workflows/auto-merge-dependabot.yml

diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml
new file mode 100644
index 0000000..8e20b09
--- /dev/null
+++ b/.github/workflows/auto-merge-dependabot.yml
@@ -0,0 +1,23 @@
+name: Auto-merge Dependabot PRs
+
+on: pull_request_target
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Approve PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ github.token }}
+      - name: Enable auto-merge
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ github.token }}

From 98ea6a39bba976ceb10d7c4a88a43ccc13a872ff Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Apr 2026 11:54:02 +0000
Subject: [PATCH 2/3] Exclude auto-merge workflow from generated template

The auto-merge workflow requires repo settings (allow auto-merge,
branch protection) that can't be codified in files. Exclude it from
the template so generated repos don't ship with a broken workflow.

https://claude.ai/code/session_01UWiK5bH6Be6vft43zVVNbH
---
 .github/workflows/generate-template.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/generate-template.sh b/.github/workflows/generate-template.sh
index b650af9..eaa798e 100755
--- a/.github/workflows/generate-template.sh
+++ b/.github/workflows/generate-template.sh
@@ -28,8 +28,8 @@ while IFS= read -r -d '' entry; do
     fi
 done < <("${FILE_CMD[@]}")
 
-# Remove files only needed for template generation
-rm --recursive --force -- "$DEST/.template" "$DEST/.github/workflows/generate-template."{yml,sh}
+# Remove files only needed for template generation or this specific repo
+rm --recursive --force -- "$DEST/.template" "$DEST/.github/workflows/generate-template."{yml,sh} "$DEST/.github/workflows/auto-merge-dependabot.yml"
 
 # Normalize version so generated projects don't inherit the template repo's version
 sed --in-place 's/^version = ".*"/version = "0.1.0"/' "$DEST/pyproject.toml"

From 11df56c2e765a2df533a306dcb9a6315e77b0010 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 13 Apr 2026 11:57:11 +0000
Subject: [PATCH 3/3] Switch auto-merge to workflow_run trigger (no branch
 protection needed)

Instead of pull_request_target + --auto (which requires branch
protection and the "Allow auto-merge" repo setting), trigger on
workflow_run after the Test workflow succeeds. This merges directly
once tests pass, with no repo settings required.

Security: workflow_run always runs base branch code, never checks
out PR code, and the PR author is verified both via the event actor
and a redundant API check.

https://claude.ai/code/session_01UWiK5bH6Be6vft43zVVNbH
---
 .github/workflows/auto-merge-dependabot.yml | 30 ++++++++++++++-------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml
index 8e20b09..945d5e3 100644
--- a/.github/workflows/auto-merge-dependabot.yml
+++ b/.github/workflows/auto-merge-dependabot.yml
@@ -1,6 +1,9 @@
 name: Auto-merge Dependabot PRs
 
-on: pull_request_target
+on:
+  workflow_run:
+    workflows: ["Test"]
+    types: [completed]
 
 permissions:
   contents: write
@@ -8,16 +11,23 @@ permissions:
 
 jobs:
   auto-merge:
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - name: Approve PR
-        run: gh pr review --approve "$PR_URL"
+      - name: Find and merge Dependabot PR
         env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ github.token }}
-      - name: Enable auto-merge
-        run: gh pr merge --auto --squash "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          pr_number=$(gh api "repos/$REPO/commits/$HEAD_SHA/pulls" \
+            --jq 'map(select(.user.login == "dependabot[bot]")) | .[0].number')
+          if [ -z "$pr_number" ] || [ "$pr_number" = "null" ]; then
+            echo "No Dependabot PR found for SHA $HEAD_SHA"
+            exit 0
+          fi
+          gh pr review --approve "$pr_number" -R "$REPO"
+          gh pr merge --squash "$pr_number" -R "$REPO"