ci: auto-approve Dependabot non-major bumps before auto-merge#615
Merged
Conversation
Adds a `gh pr review --approve` step so Dependabot's own patch/minor PRs satisfy the branch's require-1-review rule automatically, then enable auto-merge as before. Human PRs get no bot approval and still need a human reviewer. Major bumps are neither approved nor auto-merged. Pairs with branch-protection changes: required approvals set to 1 and the single-user push restriction removed so the Actions token can merge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements "human PRs gated by review, Dependabot flows through automatically."
Workflow change: the Dependabot auto-merge job now runs
gh pr review --approvebefore enabling auto-merge, for non-major bumps only. The bot's approval satisfies the require-1-review rule for Dependabot's own PRs; human PRs get no such approval and still need a human reviewer. Major bumps are neither approved nor auto-merged (a human reviews + merges them).Companion branch-protection changes (applied after this merges):
main— otherwise the Actions token still can't merge even after approving (this was theenablePullRequestAutoMerge"not authorized" error).mainremains protected by the required review + the 4 required checks.Already in place: "Allow GitHub Actions to approve PRs" (
can_approve_pull_request_reviews: true);dismiss_stale_reviews: false(so the bot's approval survives Dependabot rebases).Note:
enforce_adminsstays off, so admins still bypass — human-PR review is enforced for non-admins.🤖 Generated with Claude Code