Skip to content

chore(ci): dependabot monthly + auto-merge patch/minor (stop version-bump babysitting) #194

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
emeraldleaf wants to merge 4 commits into
base: main
Choose a base branch
from
+70 −2
Open

chore(ci): dependabot monthly + auto-merge patch/minor (stop version-bump babysitting) #194

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c4ccc22
chore(ci): dependabot monthly + auto-merge patch/minor — stop version…
emeraldleaf Jul 20, 2026
6d046ad
chore(deps): ignore Aspire minor/patch — needs coordinated SDK+Messag…
emeraldleaf Jul 20, 2026
6271896
chore(deps): ignore NSubstitute majors — 6.0 needs a code fix (CS8602…
emeraldleaf Jul 20, 2026
2980123
Merge branch 'main' into chore/dependabot-monthly-automerge
emeraldleaf Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 20 additions & 2 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,11 @@ updates:
- package-ecosystem: nuget
directory: /
schedule:
interval: weekly
day: monday
# Monthly, not weekly — batches a month of bumps into one wave instead of four,
# so the PR volume (one per group) lands 12×/year not 52×. Patch/minor auto-merge
# (see .github/workflows/dependabot-auto-merge.yml) clears the routine ones without
# a human; only majors wait for a person.
interval: monthly
open-pull-requests-limit: 5
labels:
- dependencies
Expand Down Expand Up @@ -62,6 +65,16 @@ updates:
# paths still behave. Add majors back to the ignore list as they ship
# breaking changes; remove when a dedicated migration PR has landed.
ignore:
# Aspire minor/patch bumps can't land as a lone dependabot PR: dependabot updates the
# Aspire.Hosting.* PackageVersions but CANNOT touch the Aspire.AppHost.Sdk pin in
# NextAurora.AppHost.csproj (an MSBuild SDK ref, not a NuGet PackageReference), so the
# SDK/runtime skew fails at build/startup (CLAUDE.md "Aspire SDK and runtime packages
# must match"). Aspire bumps also drag MessagePack (via StreamJsonRpc), colliding with
# the security pin. So Aspire is a DELIBERATE, coordinated bump (Hosting packages + SDK +
# MessagePack, build-verified), not a weekly auto-PR. Ignore minor/patch; a major still
# shows up (it needs a migration PR anyway). Precedent: #189 closed for exactly this.
Comment thread
emeraldleaf marked this conversation as resolved.
- dependency-name: "Aspire.*"
update-types: ["version-update:semver-minor", "version-update:semver-patch"]
# WolverineFx majors are deferred pending a dedicated migration PR — a
# major can break host startup or the saga/outbox/concurrency paths, and
# shouldn't land as an unreviewed weekly bump. The 5→6 migration already
Expand All @@ -70,6 +83,11 @@ updates:
# `wolverine` group above keeps the whole family in step).
- dependency-name: "WolverineFx*"
update-types: ["version-update:semver-major"]
# NSubstitute 6.0 tightened Arg.Is<T> predicate nullability (CS8602 under
# TreatWarningsAsErrors); a test-mock major isn't worth a code change on a weekly
# bump. 5.x is stable. Take 6.x deliberately if there's a reason. #192 closed for this.
- dependency-name: "NSubstitute"
update-types: ["version-update:semver-major"]

- package-ecosystem: github-actions
directory: /
Expand Down
50 changes: 50 additions & 0 deletions .github/workflows/dependabot-auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Dependabot auto-merge

# Auto-merges routine dependency bumps so version churn stops landing in a human's lap.
# Patch + minor updates: approved and set to auto-merge (GitHub merges them once every
# required check is green — the same CI gate a human would wait for). MAJOR updates are
# left alone: a major can carry breaking API changes (FluentValidation 11→12 was one this
# repo saw), so those still want a person to read the release notes.
#
# Scope: dependabot-authored PRs only. Nothing here can merge human PRs.
#
# NOTE on the review requirement: if the branch ruleset requires an approving review,
# the `gh pr review --approve` step below (run as the github-actions bot) satisfies it —
# BUT only if the org/repo setting "Allow GitHub Actions to create and approve pull
# requests" is enabled (Settings → Actions → General). If that's off, the approve step
# fails and auto-merge waits forever; either enable that setting or add `dependabot[bot]`
# to the ruleset's bypass list.

on: pull_request

Comment on lines +18 to +19

@coderabbitai coderabbitai Bot Jul 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Add a missing concurrency: group.

Adding a concurrency group prevents multiple instances of this workflow from running simultaneously on the same PR, saving CI resources and preventing race conditions during auto-merge.

As per path instructions, DO flag missing concurrency: groups.

🚦 Proposed fix 
 on: pull_request
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on: pull_request
on: pull_request
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 18-18: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-auto-merge.yml around lines 18 - 19, Add a
top-level concurrency configuration to the dependabot auto-merge workflow, using
a group key derived from the pull request identifier so runs for the same PR
cannot execute simultaneously. Preserve the existing pull_request trigger and
workflow behavior, and configure the group to handle any prior run according to
the repository’s standard cancellation policy.

Source: Path instructions

permissions:
contents: write
pull-requests: write

jobs:
auto-merge:
runs-on: ubuntu-latest
if: github.actor == 'dependabot[bot]'
steps:
- name: Fetch dependabot metadata
id: meta
uses: dependabot/fetch-metadata@v2

- name: Approve + enable auto-merge for patch/minor
if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'
run: |
gh pr review --approve "$PR_URL"
gh pr merge --auto --squash "$PR_URL"
Comment on lines +35 to +37

@coderabbitai coderabbitai Bot Jul 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Include set -euo pipefail in bash run blocks.

Applying strict bash execution flags ensures that any unhandled errors or unbound variables cause the script to fail immediately, preventing unintended behavior. As per path instructions, DO flag missing set -euo pipefail in bash run blocks.

  • .github/workflows/dependabot-auto-merge.yml#L35-L37: Add set -euo pipefail at the start of the run block.
  • .github/workflows/dependabot-auto-merge.yml#L44-L47: Add set -euo pipefail at the start of the run block.
🛠️ Proposed fixes

For lines 35-37:

         run: |
+          set -euo pipefail
           gh pr review --approve "$PR_URL"

For lines 44-47:

         run: |
+          set -euo pipefail
           gh pr comment "$PR_URL" --body "🔎 **Major version bump — held for manual review.** \
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: |
gh pr review --approve "$PR_URL"
gh pr merge --auto --squash "$PR_URL"
run: |
set -euo pipefail
gh pr review --approve "$PR_URL"
gh pr merge --auto --squash "$PR_URL"
📍 Affects 1 file
  • .github/workflows/dependabot-auto-merge.yml#L35-L37 (this comment)
  • .github/workflows/dependabot-auto-merge.yml#L44-L47
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-auto-merge.yml around lines 35 - 37, Add set
-euo pipefail as the first command in both bash run blocks in
.github/workflows/dependabot-auto-merge.yml at lines 35-37 and 44-47, before the
existing gh commands.

Source: Path instructions

env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Flag majors for manual review
if: steps.meta.outputs.update-type == 'version-update:semver-major'
run: |
gh pr comment "$PR_URL" --body "🔎 **Major version bump — held for manual review.** \
Auto-merge covers patch/minor only; a major can carry breaking changes (read the release \
notes, check the saga/outbox/concurrency paths, then merge)."
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Loading