Skip to content

feat: Dependabot with auto-merge on CI success #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jamie-BitFlight merged 4 commits into from
Feb 22, 2026
Merged

feat: Dependabot with auto-merge on CI success #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
52e31ea
Initial plan
Copilot Feb 22, 2026
b11b3c6
feat: add Dependabot config and auto-merge workflow
Copilot Feb 22, 2026
e59bd67
fix: resolve zizmor CI failures in dependabot config and auto-merge w…
Copilot Feb 22, 2026
1ab55b5
fix: resolve remaining zizmor CI failures and address review comments
Copilot Feb 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
version: 2
updates:
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"
Copy link

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The pip ecosystem configuration should include a groups specification. Looking at pyproject.toml, the project uses dependency groups (dev group with tools like pytest, mypy, ruff). Without the groups field, Dependabot will only update runtime dependencies, not dev dependencies. Add groups: ["dev"] to ensure dev dependencies are also kept up to date.

Suggested change
interval: "weekly"
interval: "weekly"
groups:
- "dev"

Copilot uses AI. Check for mistakes.
cooldown:
default-days: 7
open-pull-requests-limit: 5
labels:
- "dependencies"
- "python"

- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7
open-pull-requests-limit: 5
labels:
- "dependencies"
- "github-actions"
Comment on lines +1 to +23
Copy link

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Dependabot configuration should include additional security settings. The configuration is missing important fields like open-pull-requests-limit (defaults to 5, which may overwhelm CI), rebase-strategy (to handle conflicts), and versioning-strategy (important for GitHub Actions). Consider adding these for better control. For example, limiting open PRs to 3, and for the github-actions ecosystem, consider adding versioning-strategy: "increase" to ensure SHA-pinned actions are updated correctly.

Copilot uses AI. Check for mistakes.
37 changes: 37 additions & 0 deletions .github/workflows/dependabot-auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
name: Dependabot Auto-Merge

on:
pull_request:
branches: ["**"]

permissions: {}

jobs:
auto-merge:
name: Auto-merge Dependabot PRs
runs-on: ubuntu-latest
if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
permissions:
contents: write
pull-requests: write

steps:
- name: Fetch Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
with:
github-token: ${{ secrets.GITHUB_TOKEN }}

- name: Approve PR
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
run: gh pr review --approve "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Enable auto-merge
if: steps.metadata.outputs.update-type != 'version-update:semver-major'
run: gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +30 to +37
Copy link

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The approval step may fail with a "cannot review your own pull request" error. GitHub Actions' GITHUB_TOKEN is tied to the github-actions[bot] account, but Dependabot PRs are authored by dependabot[bot]. While these are different bot accounts, the approval may still be rejected if GitHub treats them as the same entity or if branch protection rules require human approval. Consider testing this behavior or using a GitHub App token with proper permissions, or document that branch protection must allow bot approvals.

Suggested change
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Enable auto-merge
run: gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GH_TOKEN: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }}
- name: Enable auto-merge
run: gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }}

Copilot uses AI. Check for mistakes.
Comment on lines +32 to +37
Copy link

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The auto-merge step lacks error handling and doesn't verify that approval succeeded first. If the previous approval step fails but continues, this step will attempt to enable auto-merge on an unapproved PR, which will fail. The workflow should either fail fast on approval errors or check if approval succeeded before attempting auto-merge. Consider adding a conditional check or proper error handling between these steps.

Copilot uses AI. Check for mistakes.
Comment on lines +9 to +37
Copy link

Copilot AI Feb 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is missing security filtering for Dependabot PR types. Currently, it will auto-approve and auto-merge all Dependabot PRs regardless of whether they are patch, minor, or major version updates. Major version updates can introduce breaking changes. Consider adding logic to filter by update type (e.g., only auto-merge patch and minor updates) or by dependency criticality. You can access this information via github.event.pull_request.labels or by parsing the PR title/body.

Copilot uses AI. Check for mistakes.