Repository navigation
Conversation
Grouped Dependabot updates with the low-risk ones (security, minor/patch) auto-merged on green CI; majors stay manual. Plus standarization of existing github workflows across all repos.
This was referenced Oct 29, 2026
aaccensi
marked this pull request as ready for review
October 29, 2026 16:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Part of the fleet-wide Dependabot standardization. It consists of giving every app and gem the same Dependabot setup and the same policy for vetting updates (or as close as possible).
Dependabot opens grouped PRs. Security fixes and minor/patch bumps are auto-merged once CI is green (CI is the "nothing breaks" gate for semver-compatible updates). Majors are not merged automatically: they're collected into a single standing "major-updates" dashboard PR that stays open as a list of what we're behind on, and we can decide what to do with them by hand, one at a time.
Implemented changes
.github/dependabot.yml— grouped Dependabot config: asecuritygroup, a minor/patchdependenciesgroup, and amajor-updatesgroup, across the repo's package ecosystem(s) and GitHub Actions..github/workflows/dependabot-auto-merge.yml— approves and auto-merges thesecurityanddependenciesgroups on green CI (direct majors excluded)..github/workflows/label-pull-requests.yml+ ado-not-mergelabel — flags the standingmajor-updatesdashboard PR so it isn't merged as a unit.major-updatesdashboard branch — it bundles breaking changes, never goes green, and is never merged, so there's nothing to test..github/workflows/mark-stale-items.yml— sweeps stale issues/PRs.Related
7 Apps
10 Gems
Checklist