Migrate to frequenz-floss dependabot-auto-approve action #126
Conversation
Signed-off-by: Mathias L. Baumann <[email protected]>
github-actions
bot
added
the
part:tooling
There was a problem hiding this comment.
Pull Request Overview
This PR introduces an automated workflow for managing Dependabot pull requests. The workflow will automatically approve and merge all Dependabot PRs without running any tests or checks.
- Adds auto-approval and auto-merge functionality for all Dependabot updates
- Uses the
frequenz-floss/dependabot-auto-approveaction with SHA pinning - Configures merge method as "merge" and adds an "auto-merged" label
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| dependency-type: 'all' | ||
| auto-merge: 'true' |
There was a problem hiding this comment.
Auto-merging all Dependabot PRs without requiring CI checks to pass is risky. The workflow should include a check to ensure CI tests have passed before merging. Consider adding a needs dependency on CI jobs or configuring branch protection rules to require status checks.
| with: | ||
| dependency-type: 'all' | ||
| auto-merge: 'true' | ||
| merge-method: 'merge' |
There was a problem hiding this comment.
[nitpick] The merge method 'merge' creates merge commits, which differs from the typical squash merge pattern often used for dependency updates. Consider using 'squash' to maintain a cleaner git history, or ensure this aligns with the project's merge strategy for Dependabot PRs.
| merge-method: 'merge' | |
| merge-method: 'squash' |
| @@ -0,0 +1,18 @@ | |||
| name: Dependabot Auto Manage | |||
| on: pull_request | |||
There was a problem hiding this comment.
Using the 'pull_request' trigger without specifying types means this workflow runs on every PR action (opened, synchronized, reopened, etc.), potentially triggering multiple auto-merge attempts. Consider specifying the trigger type as 'on: pull_request: types: [opened]' or ensuring the action is idempotent for repeated runs.
| on: pull_request | |
| on: | |
| pull_request: | |
| types: [opened] |
Use commit hash instead of version tag for better security and reproducibility. Signed-off-by: Mathias L. Baumann <[email protected]>
Marenz
force-pushed
the
update-dependabot-action
branch
from
911b53b to
cf2cbc0
Compare
2 participants
Use commit hash instead of version tag for better security and reproducibility.