ci: auto-approve major Dependabot updates#275
Merged
Conversation
Remove the semver-patch/minor guards so the bot approves and enables auto-merge for all Dependabot PRs, including major version bumps. With 2 required reviewers, the bot approval still leaves a human review gate before auto-merge completes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ksroda-sa
requested review from
artursmolarek,
Copilot,
dfranco-sa,
jgutikonda-sa,
jkotiuk,
justintvnguyen,
lgonczarik and
rharasani-sa
There was a problem hiding this comment.
Pull request overview
Updates the Dependabot auto-merge GitHub Actions workflow to auto-approve and enable auto-merge for all Dependabot PRs, including major version updates, removing the previous semver patch/minor gating.
Changes:
- Removed
semver-patch/semver-minorconditional guards from the “Approve PR” step. - Removed
semver-patch/semver-minorconditional guards from the “Enable auto-merge” step. - Updated the workflow comment to reflect the new “approve all update types” behavior.
Comments suppressed due to low confidence (1)
.github/workflows/dependabot-auto-merge.yml:29
- Same as above: add a brief note explaining why a PAT is required here, since it carries higher risk than
github.tokenand is used on every Dependabot PR run.
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ikawalec
previously approved these changes
Jun 22, 2026
The fetch-metadata step only existed to gate on update-type; with the semver guards removed, nothing references it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
pull_request.user.login is the PR author and stays dependabot[bot] for the PR's lifetime, so a human pushing commits to a Dependabot branch would otherwise trigger an auto-approval of their own changes. Require github.actor to be dependabot[bot] as well. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ikawalec
approved these changes
Jun 23, 2026
bwereszczak
approved these changes
Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes the
semver-patch/semver-minorguards from the Dependabot auto-merge workflow so the bot approves and enables auto-merge for all Dependabot PRs, including major version bumps.Why
Major bumps (e.g. #268,
actions/checkoutv6→v7) previously got no bot approval and had to be approved fully manually. With 2 required reviewers configured, the bot approval still leaves a human review gate before auto-merge completes, so this just removes the extra manual approval click without bypassing review.🤖 Generated with Claude Code