Skip to content

feat: add Dependabot auto-merge workflow #327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cruddasj merged 1 commit into from
Aug 30, 2026
Merged

feat: add Dependabot auto-merge workflow #327

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/dependabot-auto-merge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Dependabot auto-merge

on:
pull_request:

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Run auto-merge in a writable event context

For Dependabot-authored PRs, this pull_request trigger runs in a fork-equivalent security context, so GitHub downgrades GITHUB_TOKEN to read-only despite the requested write permissions (GitHub documentation). Consequently, gh pr merge --auto --merge cannot update the PR and this workflow fails instead of enabling auto-merge; use a trusted pull_request_target or post-CI workflow_run context without executing code from the Dependabot branch.

Useful? React with 👍 / 👎.


permissions:
contents: write
pull-requests: write

jobs:
dependabot:
runs-on: ubuntu-latest
if: github.event.pull_request.user.login == 'dependabot[bot]'
steps:
- name: Fetch Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Enable auto-merge
run: gh pr merge --auto --merge "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}