[blink1073]

Summary

• Add an opt-in auto-merge input to pre-commit-autoupdate and poetry-lock-update that enables squash auto-merge on the PRs they open, and enable it in this repo's workflows.
• Add a dependabot-auto-merge workflow that approves and enables auto-merge for patch/minor Dependabot updates.
• Stagger the maintenance schedules to avoid interference: Poetry lock (Mon), Dependabot (Tue), pre-commit autoupdate (Wed).

Notes

• Auto-merge requires "Allow auto-merge" enabled in repo settings; merges once required checks pass.
• dependabot/fetch-metadata is hash-pinned to satisfy zizmor's unpinned-uses policy.

[greptile-apps]

Confidence Score: 4/5

[High impact] Enables automatic merging of dependency and maintenance update pull requests.

The PR appears safe to merge, with non-blocking improvements to error reporting, update filtering, and tests.

Findings

1.  Failed lookup looks successful ▶
2.  Unknown updates pass the filter ▶
3.  Merge paths lack tests ▶

Summary

Adds optional squash auto-merge to the two maintenance actions and enables it in this repository.

• Update actions can queue squash merges after required checks pass.
• Dependabot non-major pull requests can queue squash auto-merge.
• Dependabot runs Tuesday and pre-commit updates run Wednesday.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Maintenance update] --> B{Changes found?}
  B -->|No| C[Stop]
  B -->|Yes| D[Create or update PR]
  D --> E{Auto-merge enabled and not dry-run?}
  E -->|Yes| F[Enable squash auto-merge]
  E -->|No| G[Leave PR for manual merge]
  H[Dependabot PR] --> I[Read update metadata]
  I --> J{Not classified as major?}
  J -->|Yes| K[Approve and enable squash auto-merge]
  J -->|No| G

Loading

_{Reviews (1) · Last reviewed commit: "feat: auto-merge update PRs and stagger ..." · Reviewed by Greptile}

[greptile-apps]

Failed lookup looks successful

If gh pr view fails, its empty output makes this comparison false. The step then finishes successfully without enabling auto-merge, leaving the PR waiting for manual action. Capture the result separately and stop on a failed lookup before checking autoMergeRequest.

Suggested change

	if [ "$(gh pr view "$BRANCH" --json autoMergeRequest --jq '.autoMergeRequest')" = "null" ]; then
	AUTO_MERGE_REQUEST=$(gh pr view "$BRANCH" --json autoMergeRequest --jq '.autoMergeRequest') || exit $?
	if [ "$AUTO_MERGE_REQUEST" = "null" ]; then

[greptile-apps]

Unknown updates pass the filter

This condition accepts every update-type except the exact major-update value, including an empty or unfamiliar value. That could enable auto-merge without confirming the update is patch or minor. Explicitly allow those two values so unknown metadata leaves the PR for review.

Suggested change

	if: steps.meta.outputs.update-type != 'version-update:semver-major'
	if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor'

[greptile-apps]

Merge paths lack tests

Neither new auto-merge path has test coverage. Both action tests use dry-run, and the existing PR helper tests never run these commands. Mistakes in when poetry-lock-update or pre-commit-autoupdate merges PRs can therefore pass unnoticed. Add tests with a fake gh for opt-in merging, dry-run and disabled inputs, an already-enabled PR, and lookup failures.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!