Skip to content

ci(dependabot): run auto-merge on pull_request instead of pull_request_target #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iLevyTate merged 1 commit into from
Nov 9, 2026
Merged

ci(dependabot): run auto-merge on pull_request instead of pull_request_target #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion .github/WORKFLOW_README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ This repository is configured with automated dependency updates and release buil
### 2. Dependabot Auto-merge (`.github/workflows/dependabot-automerge.yml`)

- **Off unless the repo Variable `DEPENDABOT_AUTOMERGE` is `true`.**
- Runs on `pull_request` (GitHub's documented Dependabot pattern), not `pull_request_target`, which
GitHub is blocking by default on public repos.
- When on, enables GitHub auto-merge (squash) for patch and minor Dependabot updates; major updates
wait for manual review.
- Auto-merge waits only for checks that branch protection marks **required**. With no required
Expand All @@ -24,7 +26,8 @@ This repository is configured with automated dependency updates and release buil
**Optional Setup**: If your repository has branch protection requiring PR approval:

1. Create a Personal Access Token (PAT) with `repo` scope
2. Add it as a repository secret named `DEPENDABOT_PAT`
2. Add it as a **Dependabot** secret named `DEPENDABOT_PAT` (Settings → Secrets and variables →
Dependabot); runs triggered by Dependabot cannot read ordinary Actions secrets
3. Uncomment the auto-approve step in the workflow

### 3. CI (`.github/workflows/ci.yml`)
Expand Down
16 changes: 14 additions & 2 deletions .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,13 @@
name: Dependabot Auto-merge
# `pull_request`, not `pull_request_target`: this is GitHub's documented
# Dependabot auto-merge pattern, and GitHub is making pull_request_target
# blocked by default on public repos (a scheduled brownout already stopped this
# workflow from starting on 2026-11-09). A Dependabot-triggered run gets a
# read-only GITHUB_TOKEN that the `permissions` block below raises, and only
# Dependabot secrets; the job needs neither a secret nor the base-branch
# context that pull_request_target existed for.
on:
pull_request_target:
pull_request:
types: [opened, synchronize, reopened, ready_for_review]

permissions:
Expand All @@ -19,9 +26,14 @@ jobs:
# when main has no rule requiring the CI checks, GitHub auto-merge has
# nothing to wait for and merges the moment it is enabled (PRs #5, #6
# and #8 merged ~12 s after opening, before CI started). Turn it on only
# after main requires the CI checks to pass.
# after main requires the CI checks to pass. If the variable ever does not
# reach a Dependabot-triggered run, the condition is false and the job
# skips, so the failure mode is "auto-merge off", never "merge unchecked".
#
# The repository check keeps forks of this repo from running the job.
if: >-
vars.DEPENDABOT_AUTOMERGE == 'true' &&
github.repository == 'iLevyTate/StratoSortStack' &&
github.event.pull_request.user.login == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
Expand Down
Loading