Auto-merge low-risk Dependabot bumps - #69
Merged
Merged
Conversation
Ports the workflow from random-mcp-server. Scope: all github-actions
updates, plus npm/docker minor + patch. Majors always stay manual, and
this session showed why — the TypeScript 5.9 -> 7.0 bump broke the build
outright (TS7016) and the Node 24 -> 25 base image was declined for being
non-LTS. Both needed a human.
Two deliberate differences from the source workflow:
- Merges with --merge, not --squash, to match this repo's history.
- Tests the npm ecosystem with startsWith('npm') rather than a literal.
package-ecosystem is Dependabot's internal id, not the friendly name in
dependabot.yml: npm reports as `npm_and_yarn`. random-mcp-server has
this bug today — it tests `== 'pip'` while its real output is `uv`, so
its Python bumps never auto-merge.
Auto-merge is only safe with required checks to wait on, so main is now
protected requiring `test` and `docker`. enforce_admins stays off so
direct version-bump pushes to main still work, and no review is required
(a review requirement would stall every Dependabot PR on a solo repo).
Condition verified against this session's real PRs: actions/fast-uri/
cucumber auto-merge; the TypeScript and Node majors stay manual.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ports the auto-merge workflow from
random-mcp-server.Scope: all
github-actionsupdates, plusnpm/dockerminor and patch. Majors always stay manual — and this session showed why: the TypeScript 5.9 → 7.0 bump broke the build outright (TS7016) and the Node 24 → 25 base image was declined for being non-LTS. Both needed a human.Required settings (already applied)
Auto-merge is only safe if there are required checks for it to wait on. With none, GitHub merges as soon as the PR is mergeable — landing bumps without CI gating them, the opposite of the intent.
random-serverhadallow_auto_merge: falseand no branch protection, so both were configured:allow_auto_mergetruegh pr merge --autoerrors without itmaintest,dockerenforce_adminsfalsemainstill workstrictfalseTwo deliberate differences from the source
Merges with
--merge, not--squash— matches this repo's all-merge-commit history.Tests npm with
startsWith('npm'), not a literal.package-ecosystemis Dependabot's internal identifier, not the friendly name independabot.yml: npm reports asnpm_and_yarn, Actions asgithub_actions. Confirmed from a real run log and from thedependabot/<ecosystem>/branch prefixes.Verification
Condition simulated against this session's actual PRs:
🤖 Generated with Claude Code