Repository navigation
ci: auto-merge minor and patch Dependabot updates - #151
Conversation
- approve and enable squash auto-merge on Dependabot pull requests for semver-minor and semver-patch updates, bound to the inspected head - a push by anyone else disarms auto-merge; major updates stay manual - runs on pull_request_target without checking out pull request code, with the organisation's release App token Closes #150
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 14 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b2e122adc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
 [High impact] No identified issues block merging this change.
|
A manual "Re-run jobs" keeps the actor as Dependabot but makes the maintainer the triggering actor, so the metadata step was skipped and the rerun approved nothing. A later attempt of a run Dependabot caused now runs it too; --match-head-commit still refuses a moved head.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 016ae8f4df
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- disarm only on a synchronize event caused by someone else; a rerun keeps the original actor, so a failed disarm can be retried and a rerun of a Dependabot run never disarms - a reopened pull request goes through the metadata check and is armed again - arm only while the pull request is a single commit: fetch-metadata verifies the first commit alone, so one carrying someone else's commits is left for manual review - note why the App token needs no workflows permission
1 participant
Summary
Dependabot pull requests stayed open after CI passed (e.g. #146) because nothing enabled auto-merge. This adds the
dependabot-auto-merge.ymlworkflow the other structured-world repositories use:--match-head-commit, so the merge waits for the required checks and refuses a moved head.pull_request_target(Dependabotpull_requestruns get no Actions secrets) and never checks out pull request code; third-party actions are pinned to commit SHAs. The token comes from the organisation's release App (RELEASER_APP_*, already used by release-plz).Testing
pull_request_targetruns the workflow from the base branch, so it takes effect only after this is merged. Already-open Dependabot pull requests pick it up on their next event (a rebase or@dependabot rebase).Closes #150