Cut releases for auto-merged Dependabot PRs - #123
Merged
Conversation
Enable Dependabot auto-merge with a token from the froefam-automerge GitHub App instead of GITHUB_TOKEN. A merge that GITHUB_TOKEN pushes does not start another workflow run, so main.yml (compute-version / publish / auto-release) never fired for an auto-merged PR and those dependency updates shipped no version tag, release, or image. The App identity makes the merge behave like a human merge. Also drops the workflow's GITHUB_TOKEN permissions to read-only, since the write identity is now the app token, and documents the new App / secret / variable in docs/CI-CD.md. Closes #122 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016RjYwAbyYDjXBfLSdYoSdi
Contributor
|
🟢 SemVer classification: Rationale: Changes are CI/infrastructure workflow improvements (.github/) and documentation updates (docs/) with no impact on application code, deployment, or user-facing behavior. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
The failure() step also fires when Fetch Dependabot metadata fails, so don't attribute the failure specifically to the token/merge step. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016RjYwAbyYDjXBfLSdYoSdi
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
automerge.ymlenabled GitHub auto-merge withsecrets.GITHUB_TOKEN, so the eventual merge landed asgithub-actions[bot]. GitHub does not start a new workflow run from apushproduced with the defaultGITHUB_TOKEN, somain.yml(on: push: branches: [main]) never fired after an auto-merge — nocompute-version, no release, noghcr.iopublish.main.ymllast ran 2026-08-04 (human merge #116); auto-merged #117 and #120 produced no run;v1.3.4has been frozen since.Fixes #122.
The fix
Enable auto-merge with a short-lived token minted from the
froefam-automergeGitHub App (actions/create-github-app-token, SHA-pinned to v3.2.0) instead ofGITHUB_TOKEN. The merge is then attributed to the App and thepushtomaintriggersmain.ymllike a human merge. No changes tomain.yml.Also:
GITHUB_TOKENpermissions to read-only (the write identity is now the app token).if:requiresgithub.actor == 'dependabot[bot]'as well as the PR author, so a human pushing a fixup to a Dependabot branch (a human-actor run, which cannot read the Dependabot secret store) skips cleanly instead of erroring.contents: write+pull-requests: writeonly.automerge.ymlpreviously had no failure signal).Prerequisites (already done)
froefam-automergecreated underdrache42, installed on this repo only, permissions Contents RW + Pull requests RW.AUTOMERGE_APP_PRIVATE_KEYstored as a Dependabot secret (Dependabot-triggered runs only read that store).AUTOMERGE_APP_CLIENT_IDstored as an Actions variable.Verification
client-id+ variable + bothpermission-*pins): installation resolves, token mints, scoped to this repo only./code-review; all findings folded in.main.ymlfires) is only verifiable with a real Dependabot PR — see below.Deliberate scope
WakeOnLanServicenot mirrored. It ships the identicalautomerge.yml, but its releases come from a manually pushedrelease/x.y.ztag, so a skipped post-mergemain.ymldoes not block its releases. Mirroring is a separate follow-up.:latestimages will now move on dependency bumps unattended. Every auto-merged patch/minor Dependabot PR now cuts a real release and promotes:latest/:X.Y/:X.Y.Z. This is the intended effect of Auto-merged Dependabot PRs don't trigger Main Pipeline (no version bump / release / image publish) #122.After merge
main, somain.ymlruns andcompute-versionbundles the two currently-unreleased PRs (Bump the nuget-non-major group with 8 updates #117, Bump the nuget-non-major group with 6 updates #120, bothsemver: patch) into a singlev1.3.5.@dependabot rebaseBump xunit.runner.visualstudio from 3.1.5 to 4.0.0 #119 (or the next weekly run) so an eligible Dependabot PR adopts the new workflow; confirm itsDependabot Auto Mergerun enables auto-merge asfroefam-automergeand that aMain Pipelinerun appears after it merges.