From bd8c1687109a1667b46d66e09e2896091c741bab Mon Sep 17 00:00:00 2001 From: John Siracusa Date: Wed, 28 Oct 2026 02:07:44 -0400 Subject: [PATCH 1/2] ci: auto-merge Dependabot patch and minor PRs Queues native auto-merge for Dependabot patch and minor updates. The "main: require CI" ruleset holds the merge until the `required` check passes. Majors get the needs-manual-review label. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: John Siracusa --- .github/workflows/dependabot-auto-merge.yml | 53 +++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..4e86656 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,53 @@ +name: Dependabot Auto-Merge + +# Queues GitHub's native auto-merge for Dependabot patch and minor PRs. GitHub holds +# the merge until the `required` check passes (ruleset "main: require CI"), so a PR +# that fails CI never merges. Major updates get the `needs-manual-review` label and +# wait for a human. +# +# A merge to main can deploy: site-deploy.yml and console-preview.yml run on pushes +# that touch their paths. The desktop app only ships from a tag (app-release.yml). +# +# Prerequisites: the repo setting "Allow auto-merge", the ruleset above, and the +# `needs-manual-review` label. + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + +permissions: + contents: write + pull-requests: write + +concurrency: + group: dependabot-auto-merge-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + auto-merge: + # Gate on the PR author, not github.actor. Commenting on a fork PR can make + # Dependabot force-push to it, which turns the bot into the "actor" of a PR it + # did not write and defeats an actor check. The author never changes. + if: github.event.pull_request.user.login == 'dependabot[bot]' + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - name: Fetch Dependabot metadata + id: meta + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto-merge for patch and minor updates + if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor' + run: gh pr merge --auto --squash "$PR_URL" + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_URL: ${{ github.event.pull_request.html_url }} + + - name: Flag major updates for manual review + if: steps.meta.outputs.update-type == 'version-update:semver-major' + run: gh pr edit "$PR_URL" --add-label needs-manual-review + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_URL: ${{ github.event.pull_request.html_url }} From e71fd968065d94b4e6b10a60da48e125794c505f Mon Sep 17 00:00:00 2001 From: John Siracusa Date: Wed, 28 Oct 2026 02:15:33 -0400 Subject: [PATCH 2/2] ci: correct the deploy note in the Dependabot auto-merge workflow Merges made with GITHUB_TOKEN do not start push-triggered workflows, so auto-merged bumps skip the deploy and push CI runs. The earlier comment said the opposite. Co-Authored-By: Claude Sonnet 5.5 Signed-off-by: John Siracusa --- .github/workflows/dependabot-auto-merge.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 4e86656..a71e18d 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -5,8 +5,11 @@ name: Dependabot Auto-Merge # that fails CI never merges. Major updates get the `needs-manual-review` label and # wait for a human. # -# A merge to main can deploy: site-deploy.yml and console-preview.yml run on pushes -# that touch their paths. The desktop app only ships from a tag (app-release.yml). +# Merges made with GITHUB_TOKEN do not start push-triggered workflows (in harness-kit, +# bot merges ran 0 push workflows and human merges ran 3). Auto-merged bumps therefore +# skip site-deploy.yml, console-preview.yml and the push run of ci.yml, and reach +# production with the next push to main that touches the same app. The desktop app +# only ships from a tag (app-release.yml). # # Prerequisites: the repo setting "Allow auto-merge", the ruleset above, and the # `needs-manual-review` label.