Skip to content

ci(deps): auto-merge eligible non-major updates #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thedavidweng merged 1 commit into from
Oct 22, 2026
Merged

ci(deps): auto-merge eligible non-major updates #85

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 16 additions & 9 deletions .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,9 @@ jobs:
ALERT_STATE: ${{ steps.meta.outputs.alert-state }}
run: |
set -euo pipefail
# Release/review tooling stays manual even when patch/minor.
deny='googleapis/release-please-action dependabot/fetch-metadata jdx/jactionlint github/codeql-action zizmorcore/zizmor-action actions/dependency-review-action trufflesecurity/trufflehog sigstore/cosign-installer anchore/sbom-action contributor-assistant/github-action'
# Only the release driver and this gate stay manual: a broken bump there
# can change how every release is produced or how eligibility is decided.
deny='googleapis/release-please-action dependabot/fetch-metadata'
dep_names="${DEP_NAMES// /}"
for blocked in $deny; do
case ",${dep_names}," in
Expand All @@ -71,36 +72,42 @@ jobs:
reason=""

# Eligible non-major security updates bypass cooldown.
if { [ "$alert" = "OPEN" ] || [ "$alert" = "FIXED" ]; }; then
if [ "$alert" = "OPEN" ] || [ "$alert" = "FIXED" ]; then
eligible=true
reason="security-update"
fi

# Patch updates after cooldown window.
# Patch updates after the cooldown window.
if [ "$ut" = "version-update:semver-patch" ]; then
eligible=true
reason="semver-patch"
fi

# Only explicitly classified patch/minor Action updates are eligible.
# github-actions minor bumps (covers SHA pin bumps).
if [ "$eco" = "github-actions" ] || [ "$eco" = "github_actions" ]; then
if [ "$ut" = "version-update:semver-patch" ] || [ "$ut" = "version-update:semver-minor" ]; then
if [ "$ut" = "version-update:semver-minor" ]; then
eligible=true
reason="github-actions-non-major"
fi
fi

# Minor of non-production / indirect / development deps.
# Production minors stay manual (primary npm supply-chain surface).
# Minor bumps of indirect or development dependencies.
if [ "$ut" = "version-update:semver-minor" ] && [ "$dt" != "direct:production" ]; then
eligible=true
reason="minor-non-production"
reason="${reason:-indirect-or-dev-minor}"
fi

if [ "$eligible" != true ]; then
echo "skip auto-merge: ecosystem=$eco update-type=$ut dependency-type=$dt alert=$alert names=$DEP_NAMES"
exit 0
fi

# Required-review rules cannot be satisfied by the bot unless the
# repository allows Actions to approve. Approving here keeps human PRs
# behind review while letting an eligible dependency bump merge itself.
if gh pr view "$PR_URL" --json reviewDecision --jq '.reviewDecision' | grep -q REVIEW_REQUIRED; then
gh pr review "$PR_URL" --approve --body "Automated approval: classified $reason update; CI still gates the merge."
fi

echo "enable auto-merge ($reason): ecosystem=$eco update-type=$ut dependency-type=$dt alert=$alert names=$DEP_NAMES"
gh pr merge --auto --squash "$PR_URL"
Loading