Skip to content

Auto-merge Dependabot minor/patch updates - #22

Merged
dimchansky merged 1 commit into
masterfrom
ci/dependabot-auto-merge
Oct 21, 2026
Merged

dimchansky merged 1 commit into
masterfrom
ci/dependabot-auto-merge

Conversation

@dimchansky

Copy link
Copy Markdown
Owner

Dependabot PRs with minor/patch GitHub Actions updates now get auto-merge enabled by .github/workflows/dependabot-auto-merge.yml.

  • Safety: the master: require CI ruleset (already active) requires Test (Go 1.19), Test (Go oldstable), Test (Go stable) and lint to pass, so auto-merge waits for green CI. Repo admins can still push to master directly.
  • Allowlist: only semver-patch / semver-minor. Majors or unknown update types stay for manual review; majors come as separate PRs.
  • Cooldown: Dependabot proposes new action releases only after 7 days (supply-chain hardening).
  • Token: pull_request trigger, no checkout, minimal job-level permissions.

Note: merges made by GITHUB_TOKEN don't trigger the push-to-master CI run; the PR checks already ran on the same code, and the monthly scheduled run covers master. If CI job names or the Go matrix change, update the ruleset as well.

Dependabot PRs for minor and patch action updates get auto-merge enabled;
GitHub merges them only after the CI checks required by the
"master: require CI" ruleset pass. Majors stay for manual review.
New releases are proposed after a 7-day cooldown.
@dimchansky
dimchansky enabled auto-merge October 21, 2026 16:47
@dimchansky
dimchansky merged commit 166b10a into master Oct 21, 2026
5 checks passed
@dimchansky
dimchansky deleted the ci/dependabot-auto-merge branch October 21, 2026 16:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant