Skip to content

Commit 045b38b

Browse files
Copilotjonathanbossenger
Copilot
and
jonathanbossenger
committed
Add Dependabot automation workflows and implementation guide
Co-authored-by: jonathanbossenger <180629+jonathanbossenger@users.noreply.github.com>
1 parent fee65be commit 045b38b

3 files changed

Lines changed: 208 additions & 0 deletions

File tree

‎.github/workflows/dependabot-auto-approve.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Dependabot Auto-Approve
2+
on: pull_request
3+
4+
permissions:
5+
pull-requests: write
6+
7+
jobs:
8+
dependabot-approve:
9+
runs-on: ubuntu-latest
10+
if: github.actor == 'dependabot[bot]'
11+
steps:
12+
- name: Dependabot metadata
13+
id: metadata
14+
uses: dependabot/fetch-metadata@v2
15+
with:
16+
github-token: "${{ secrets.GITHUB_TOKEN }}"
17+
18+
- name: Approve Dependabot PR
19+
run: gh pr review --approve "$PR_URL"
20+
env:
21+
PR_URL: ${{ github.event.pull_request.html_url }}
22+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Dependabot Auto-Merge
2+
on: pull_request
3+
4+
permissions:
5+
contents: write
6+
pull-requests: write
7+
8+
jobs:
9+
dependabot-auto-merge:
10+
runs-on: ubuntu-latest
11+
if: github.actor == 'dependabot[bot]'
12+
steps:
13+
- name: Dependabot metadata
14+
id: metadata
15+
uses: dependabot/fetch-metadata@v2
16+
with:
17+
github-token: "${{ secrets.GITHUB_TOKEN }}"
18+
19+
- name: Enable auto-merge for Dependabot PRs
20+
run: gh pr merge --auto --merge "$PR_URL"
21+
env:
22+
PR_URL: ${{ github.event.pull_request.html_url }}
23+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎DEPENDABOT_AUTOMATION.md‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
# Dependabot Automation Workflows - Implementation Guide
2+
3+
## Overview
4+
5+
This repository includes two GitHub Actions workflows that automate Dependabot pull request management:
6+
7+
1. **Dependabot Auto-Approve** (`dependabot-auto-approve.yml`) - Automatically approves Dependabot PRs
8+
2. **Dependabot Auto-Merge** (`dependabot-auto-merge.yml`) - Enables auto-merge on Dependabot PRs
9+
10+
## How It Works
11+
12+
Both workflows trigger when a pull request is created or updated. They:
13+
14+
1. Check if the PR author is `dependabot[bot]`
15+
2. Fetch metadata about the Dependabot PR using the `dependabot/fetch-metadata` action
16+
3. Perform their respective actions (approve or enable auto-merge)
17+
18+
## Prerequisites
19+
20+
### 1. Enable Dependabot
21+
22+
Dependabot should already be enabled in your repository (via `.github/dependabot.yml`). This repository already has Dependabot configured for npm updates.
23+
24+
### 2. Enable Auto-Merge in Repository Settings
25+
26+
Auto-merge must be enabled at the repository level:
27+
28+
1. Go to your repository on GitHub
29+
2. Navigate to **Settings** → **General**
30+
3. Scroll down to the **Pull Requests** section
31+
4. Check the box for **"Allow auto-merge"**
32+
33+
### 3. Configure Branch Protection Rules (Recommended)
34+
35+
To ensure quality and safety, it's recommended to set up branch protection rules:
36+
37+
1. Go to **Settings** → **Branches**
38+
2. Add a branch protection rule for your main/trunk branch
39+
3. Configure the following settings:
40+
- ✅ **Require a pull request before merging**
41+
- ✅ **Require approvals** (at least 1)
42+
- ✅ **Require status checks to pass before merging** (if you have CI/CD)
43+
- ✅ **Require branches to be up to date before merging**
44+
45+
This ensures that even auto-merged PRs go through proper checks.
46+
47+
## No Additional Tokens Required
48+
49+
The workflows use the built-in `GITHUB_TOKEN` secret, which is automatically provided by GitHub Actions. **No additional personal access tokens or secrets need to be created.**
50+
51+
The `GITHUB_TOKEN` has sufficient permissions for:
52+
- Reading pull request metadata
53+
- Approving pull requests
54+
- Enabling auto-merge on pull requests
55+
56+
## Workflow Details
57+
58+
### Dependabot Auto-Approve Workflow
59+
60+
**File**: `.github/workflows/dependabot-auto-approve.yml`
61+
62+
**Permissions Required**:
63+
- `pull-requests: write` - To approve pull requests
64+
65+
**What it does**:
66+
1. Triggers on any pull request event
67+
2. Checks if the actor is Dependabot
68+
3. Fetches PR metadata
69+
4. Automatically approves the PR using `gh pr review --approve`
70+
71+
### Dependabot Auto-Merge Workflow
72+
73+
**File**: `.github/workflows/dependabot-auto-merge.yml`
74+
75+
**Permissions Required**:
76+
- `contents: write` - To merge pull requests
77+
- `pull-requests: write` - To modify pull request settings
78+
79+
**What it does**:
80+
1. Triggers on any pull request event
81+
2. Checks if the actor is Dependabot
82+
3. Fetches PR metadata
83+
4. Enables auto-merge using `gh pr merge --auto --merge`
84+
85+
The PR will automatically merge once all branch protection requirements are met (approvals, status checks, etc.).
86+
87+
## How to Use
88+
89+
Once the workflows are merged into your default branch, they will automatically run for all new Dependabot pull requests. No manual intervention is required.
90+
91+
### Workflow Execution Flow
92+
93+
1. Dependabot creates a PR for dependency updates
94+
2. Both workflows trigger automatically
95+
3. The auto-approve workflow approves the PR
96+
4. The auto-merge workflow enables auto-merge
97+
5. Once all branch protection checks pass, the PR merges automatically
98+
6. Dependabot may rebase or update the PR, triggering the workflows again
99+
100+
## Monitoring and Troubleshooting
101+
102+
### Viewing Workflow Runs
103+
104+
1. Go to the **Actions** tab in your repository
105+
2. Look for "Dependabot Auto-Approve" and "Dependabot Auto-Merge" workflows
106+
3. Click on individual runs to see detailed logs
107+
108+
### Common Issues
109+
110+
**Issue**: Workflows don't run
111+
- **Solution**: Ensure workflows are in the default branch (main/trunk)
112+
113+
**Issue**: Auto-merge doesn't work
114+
- **Solution**: Verify that auto-merge is enabled in repository settings
115+
116+
**Issue**: PRs aren't merging automatically
117+
- **Solution**: Check branch protection rules. The PR must pass all required status checks and approvals before it can auto-merge
118+
119+
**Issue**: Permission errors
120+
- **Solution**: Verify that GitHub Actions has write permissions in repository settings under **Settings** → **Actions** → **General** → **Workflow permissions**
121+
122+
### Customization Options
123+
124+
You can customize the workflows to be more selective about which Dependabot PRs to auto-approve/merge:
125+
126+
#### Example: Only Auto-Merge Patch Updates
127+
128+
Add additional conditions to the workflow using the metadata from `dependabot/fetch-metadata`:
129+
130+
```yaml
131+
- name: Enable auto-merge for Dependabot PRs
132+
if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
133+
run: gh pr merge --auto --merge "$PR_URL"
134+
env:
135+
PR_URL: ${{ github.event.pull_request.html_url }}
136+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
137+
```
138+
139+
#### Example: Different Behavior Based on Dependency Type
140+
141+
```yaml
142+
- name: Auto-merge development dependencies
143+
if: steps.metadata.outputs.dependency-type == 'direct:development'
144+
run: gh pr merge --auto --merge "$PR_URL"
145+
env:
146+
PR_URL: ${{ github.event.pull_request.html_url }}
147+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
148+
```
149+
150+
## Security Considerations
151+
152+
- The workflows only act on PRs created by `dependabot[bot]`, preventing unauthorized use
153+
- They use the minimal required permissions (`pull-requests: write` and `contents: write`)
154+
- Branch protection rules provide an additional safety layer
155+
- The `dependabot/fetch-metadata` action is maintained by GitHub and regularly updated
156+
157+
## References
158+
159+
- [GitHub Docs: Automating Dependabot with GitHub Actions](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions)
160+
- [GitHub Docs: Fetching metadata about a pull request](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#fetching-metadata-about-a-pull-request)
161+
- [GitHub Docs: Automatically approving a pull request](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#automatically-approving-a-pull-request)
162+
- [GitHub Docs: Enabling automerge on a pull request](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enabling-automerge-on-a-pull-request)
163+
- [dependabot/fetch-metadata Action](https://github.com/dependabot/fetch-metadata)

0 commit comments

Comments
 (0)