Conversation
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow intended to automatically approve and enable auto-merge for Dependabot pull requests, helping keep dependency updates flowing with less manual intervention.
Changes:
- Introduces a new
pull_request_targetworkflow that runs only when the PR actor isdependabot[bot] - Uses the GitHub CLI to approve the PR and enable auto-merge (squash)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| if: github.actor == 'dependabot[bot]' |
There was a problem hiding this comment.
Using if: github.actor == 'dependabot[bot]' can skip the job on manual re-runs (the actor becomes the human who re-ran the workflow). For pull_request_target, it's more reliable to gate on the PR author, e.g. github.event.pull_request.user.login, so dependabot PRs can still be re-run safely if needed.
| if: github.actor == 'dependabot[bot]' | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' |
| steps: | ||
| - run: gh pr review ${{ github.event.pull_request.html_url }} --approve |
There was a problem hiding this comment.
The workflow attempts to enable auto-merge before approving the PR (gh pr merge ... --auto runs before gh pr review --approve). If branch protection requires an approval, the merge command will fail and auto-merge won't be enabled. Swap the order so the approval happens first, then enable auto-merge.
Keeps dependabot ticking along