From 0b0632df9cb9a26e0bef376273eb2eda7b16c857 Mon Sep 17 00:00:00 2001 From: James Thompson Date: Wed, 4 Nov 2026 17:05:41 -0500 Subject: [PATCH] Use an explicit allow-list for Dependabot auto-merge An empty update-type from fetch-metadata previously satisfied the "not major" check and would have queued the PR. Only patch and minor bumps, or PRs carrying a security advisory, are now eligible. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/dependabot-auto-merge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 24b34ef..8db60a2 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -20,7 +20,7 @@ jobs: # Patch/minor bumps and any PR that fixes a security advisory are # queued for auto-merge; they still wait for the required CI checks. - name: Enable auto-merge - if: steps.metadata.outputs.update-type != 'version-update:semver-major' || steps.metadata.outputs.ghsa-id != '' + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.ghsa-id != '' run: gh pr merge --auto --merge "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }}