-
Notifications
You must be signed in to change notification settings - Fork 5
Add Dependabot auto-merge workflow #118
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: v0.x.x
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR introduces an automated workflow to streamline dependency updates by automatically approving and merging Dependabot pull requests using GitHub Actions.
Key Changes:
- New GitHub Actions workflow that triggers on pull requests from Dependabot
- Configured to use merge commits for maintaining a linear commit history
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| if: github.actor == 'dependabot[bot]' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Auto-merge Dependabot PR | ||
| uses: ad/dependabot-auto-approve@v1 | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| merge-method: 'merge' No newline at end of file |
Copilot
AI
Oct 20, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This workflow auto-merges all Dependabot PRs without any checks. Add a condition to require passing CI checks before merging, such as adding needs: [test] or checking for required status checks to prevent merging broken dependencies.
| - name: Auto-merge Dependabot PR | ||
| uses: ad/dependabot-auto-approve@v1 | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} |
Copilot
AI
Oct 20, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The default GITHUB_TOKEN may lack sufficient permissions to approve and merge PRs. Consider using a personal access token (PAT) or GitHub App token with appropriate permissions stored in secrets, such as ${{ secrets.DEPENDABOT_PAT }}.
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| github-token: ${{ secrets.DEPENDABOT_PAT }} |
56e6feb to
8b84ae6
Compare
Signed-off-by: Mathias L. Baumann <[email protected]>
8b84ae6 to
a1ed80d
Compare
Summary
mergemethod for clean commit history