Skip to content

Conversation

@Marenz
Copy link
Contributor

@Marenz Marenz commented Oct 20, 2025

Summary

  • Add GitHub workflow to automatically approve and merge Dependabot PRs
  • Uses merge method for clean commit history

@Copilot Copilot AI review requested due to automatic review settings October 20, 2025 13:27
@Marenz Marenz requested a review from a team as a code owner October 20, 2025 13:27
@Marenz Marenz requested a review from shsms October 20, 2025 13:27
@github-actions github-actions bot added the part:tooling Affects the development tooling (CI, deployment, dependency management, etc.) label Oct 20, 2025
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR introduces an automated workflow to streamline dependency updates by automatically approving and merging Dependabot pull requests using GitHub Actions.

Key Changes:

  • New GitHub Actions workflow that triggers on pull requests from Dependabot
  • Configured to use merge commits for maintaining a linear commit history

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment on lines 8 to 19
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
- name: Auto-merge Dependabot PR
uses: ad/dependabot-auto-approve@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
merge-method: 'merge' No newline at end of file
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow auto-merges all Dependabot PRs without any checks. Add a condition to require passing CI checks before merging, such as adding needs: [test] or checking for required status checks to prevent merging broken dependencies.

Copilot uses AI. Check for mistakes.
- name: Auto-merge Dependabot PR
uses: ad/dependabot-auto-approve@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
Copy link

Copilot AI Oct 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The default GITHUB_TOKEN may lack sufficient permissions to approve and merge PRs. Consider using a personal access token (PAT) or GitHub App token with appropriate permissions stored in secrets, such as ${{ secrets.DEPENDABOT_PAT }}.

Suggested change
github-token: ${{ secrets.GITHUB_TOKEN }}
github-token: ${{ secrets.DEPENDABOT_PAT }}

Copilot uses AI. Check for mistakes.
@Marenz Marenz force-pushed the add-dependabot-workflow branch 2 times, most recently from 56e6feb to 8b84ae6 Compare October 20, 2025 15:17
Signed-off-by: Mathias L. Baumann <[email protected]>
@Marenz Marenz force-pushed the add-dependabot-workflow branch from 8b84ae6 to a1ed80d Compare October 22, 2025 10:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

part:tooling Affects the development tooling (CI, deployment, dependency management, etc.)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant