Skip to content

chore: add Dependabot with auto-merge via GitHub App #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
combsmith-dependabot-automrg merged 3 commits into from
Mar 23, 2026
Merged

chore: add Dependabot with auto-merge via GitHub App #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d6f30cf
chore: add Dependabot configuration
don-petry Mar 23, 2026
eeb38c8
chore: add Dependabot auto-merge workflow
don-petry Mar 23, 2026
04ef006
fix(ci): use pull_request_target for Dependabot secret access
don-petry Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
version: 2
updates:
- package-ecosystem: 'gradle'
directory: '/'
schedule:
interval: 'weekly'
open-pull-requests-limit: 10

Comment on lines +3 to +8

Copilot AI Mar 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependabot is configured for package-ecosystem: 'gradle' in the repository root (directory: '/'), but there are no Gradle manifests at the repo root (e.g. build.gradle, build.gradle.kts, settings.gradle). This will cause Dependabot runs to fail with “manifest not found”. Either remove the Gradle entry or point directory at the folder that actually contains the Gradle project.

Suggested change
- package-ecosystem: 'gradle'
directory: '/'
schedule:
interval: 'weekly'
open-pull-requests-limit: 10

Copilot uses AI. Check for mistakes.
- package-ecosystem: 'github-actions'
directory: '/'
schedule:
interval: 'weekly'
open-pull-requests-limit: 10
38 changes: 38 additions & 0 deletions .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
name: Dependabot auto-merge

on:
pull_request_target:
branches:
- main
Comment on lines +3 to +6

Copilot AI Mar 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is triggered on pull_request, but it relies on repo secrets (APP_ID / APP_PRIVATE_KEY) to mint a GitHub App token. For Dependabot PRs, pull_request workflows typically do not receive repository secrets, so the "Generate app token" step will fail at runtime. Consider switching the trigger to pull_request_target (and avoid checking out PR code) or using a workflow_run pattern so secrets are available safely.

Copilot uses AI. Check for mistakes.

permissions:
contents: write
pull-requests: write

jobs:
dependabot:
runs-on: ubuntu-latest
if: github.event.pull_request.user.login == 'dependabot[bot]'
steps:
- name: Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@v2
with:
github-token: '${{ secrets.GITHUB_TOKEN }}'

- name: Generate app token
if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-type == 'indirect'
Comment on lines +23 to +24

Copilot AI Mar 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The auto-merge condition includes steps.metadata.outputs.dependency-type == 'indirect', which can allow merging indirect dependency updates even when they are semver-major. This doesn't match the PR description (“Patch and minor updates are automatically approved and merged”). Either tighten the condition to patch/minor only, or update the description/policy to explicitly include indirect majors.

Copilot uses AI. Check for mistakes.
id: app-token
uses: actions/create-github-app-token@v1
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.APP_PRIVATE_KEY }}

- name: Approve and auto-merge
if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-type == 'indirect'
run: |
gh pr review --approve "$PR_URL"
gh pr merge --squash --admin "$PR_URL"

Copilot AI Mar 23, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

gh pr merge --admin bypasses branch protection requirements and can merge updates before required checks/reviews have completed. If the intent is to respect protections, prefer using GitHub auto-merge (e.g. gh pr merge --auto --squash) and drop --admin, so merges only happen after required status checks pass.

Suggested change
gh pr merge --squash --admin "$PR_URL"
gh pr merge --auto --squash "$PR_URL"

Copilot uses AI. Check for mistakes.
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}