From e852b18ed86cfbae4c17487d554ee90ec2525aab Mon Sep 17 00:00:00 2001 From: Dave Rogers Date: Mon, 10 Aug 2026 17:40:56 -0700 Subject: [PATCH] ci: auto-merge dependabot patch bumps for dev and transitive deps (#4915) Co-Authored-By: Claude Fable 5 --- .github/workflows/dependabot-auto-merge.yml | 27 +++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 000000000..8a5bc0438 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,27 @@ +name: Dependabot auto-merge +on: pull_request + +permissions: + contents: write + pull-requests: write + +jobs: + auto-merge: + runs-on: ubuntu-latest + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'DataBiosphere/data-browser' + steps: + - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + id: metadata + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" + # Auto-merge only patch-level bumps of dev-only or transitive dependencies; + # runtime dependencies and minor/major bumps stay manual. + - if: | + steps.metadata.outputs.update-type == 'version-update:semver-patch' && + contains(fromJSON('["direct:development", "indirect"]'), steps.metadata.outputs.dependency-type) + run: | + gh pr review --approve "$PR_URL" + gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}