fix(ci): repair Dependabot auto-merge via native auto-merge - #281
Merged
Conversation
The auto-merge workflow has not merged anything since late January. It posted `@dependabot squash and merge` on each pull request, but GitHub removed that command — along with `@dependabot merge`, `cancel merge`, `close` and `reopen` — on 27 January 2026. Removed commands are ignored silently, with no reply and no error, so the job kept reporting success while Dependabot did nothing. Nine pull requests had accumulated. Switch to GitHub's native auto-merge (`gh pr merge --auto --squash`), which queues the pull request and merges it once the required checks pass. The merge is authenticated with AUTOMERGE_TOKEN, a fine-grained PAT, and not GITHUB_TOKEN. The `main protection` ruleset requires a code-owner approval, so only a bypass actor can merge unattended, and bypass is limited to the Admin role and the Dependabot app. The GitHub Actions app cannot be added on a user-owned repository — the API rejects it with "Actor GitHub Actions integration must be part of the ruleset source or owner organization" — so the merge must be enabled by an admin. This clears only the review requirement: auto-merge still waits for build-test and validate-game-data, so a red build blocks the merge. Until the secret exists the workflow warns rather than failing, so a missing token does not paint every Dependabot pull request red. Also stop re-posting the major-version review note on `synchronize`. It fired on every rebase, leaving three identical comments on #273.
StuartMeeks
added a commit
that referenced
this pull request
Aug 6, 2026
#281 restored the queuing half of auto-merge but not the merging half. PR #282 proved it: every check green, statusCheckRollup SUCCESS, auto-merge enabled nine seconds after Dependabot opened it — and still BLOCKED, sitting at reviewDecision REVIEW_REQUIRED. The `main protection` ruleset requires a code-owner approval, and the assumption that a bypass actor could merge without one was wrong. Bypass applies only to an interactive merge performed by that actor (`gh pr merge --admin`); GitHub's auto-merge ignores bypass entirely and waits for every merge requirement, review included. Approving #282 by hand settled it — the queued merge completed on its own three seconds later, with no other change. Approve with AUTOMERGE_TOKEN before queuing the merge. CODEOWNERS makes @StuartMeeks the owner of every path, and GITHUB_TOKEN cannot stand in: the repository disallows Actions approvals and github-actions[bot] is not a code owner. The approval re-runs on `synchronize` because the ruleset dismisses stale reviews on push and requires the approval to follow the last push. Patch and minor bumps now merge without a human reading them. That is what auto-merge means here, but it is a real change in review posture, so the workflow header states it plainly. Majors still stop for review, and required checks are never bypassed — auto-merge continues to wait for build-test and validate-game-data. Also correct the header comment from #281, which described the bypass behaviour incorrectly.
StuartMeeks
added a commit
that referenced
this pull request
Aug 6, 2026
#281 restored the queuing half of auto-merge but not the merging half. PR #282 proved it: every check green, statusCheckRollup SUCCESS, auto-merge enabled nine seconds after Dependabot opened it — and still BLOCKED, sitting at reviewDecision REVIEW_REQUIRED. The `main protection` ruleset requires a code-owner approval, and the assumption that a bypass actor could merge without one was wrong. Bypass applies only to an interactive merge performed by that actor (`gh pr merge --admin`); GitHub's auto-merge ignores bypass entirely and waits for every merge requirement, review included. Approving #282 by hand settled it — the queued merge completed on its own three seconds later, with no other change. Approve with AUTOMERGE_TOKEN before queuing the merge. CODEOWNERS makes @StuartMeeks the owner of every path, and GITHUB_TOKEN cannot stand in: the repository disallows Actions approvals and github-actions[bot] is not a code owner. The approval re-runs on `synchronize` because the ruleset dismisses stale reviews on push and requires the approval to follow the last push. Patch and minor bumps now merge without a human reading them. That is what auto-merge means here, but it is a real change in review posture, so the workflow header states it plainly. Majors still stop for review, and required checks are never bypassed — auto-merge continues to wait for build-test and validate-game-data. Also correct the header comment from #281, which described the bypass behaviour incorrectly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 AI-generated PR — Please review carefully.
Why
The auto-merge workflow has not merged anything since late January. It posted
@dependabot squash and mergeon each pull request, but GitHub removed that command — along with@dependabot merge,cancel merge,closeandreopen— on 27 January 2026.Removed commands are ignored silently: no reply, no error. The job kept reporting success while Dependabot did nothing, so the breakage was invisible until nine pull requests had piled up (#271, #273–#280).
What changed
Switch to GitHub's native auto-merge (
gh pr merge --auto --squash), which queues the pull request and merges it as soon as the required checks pass. Scope is unchanged: patch and minor auto-merge, majors get the review comment.Two smaller fixes ride along:
AUTOMERGE_TOKENexists the workflow emits a::warning::instead of failing, so the gap is visible without painting every Dependabot PR red.synchronizetoo, so every Dependabot rebase repeated it — chore(deps): bump the production-dependencies group across 1 directory with 13 updates #273 collected three identical copies. It now only posts onopened/reopened.Why a PAT rather than
GITHUB_TOKENThe
main protectionruleset requires a code-owner approval (* @StuartMeeks), so only a bypass actor can merge unattended. Bypass is limited to the Admin role and the Dependabot app — and Dependabot can no longer perform merges.Adding the GitHub Actions app was the obvious no-credential fix, but GitHub rejects it on a user-owned repository:
So the merge has to be enabled by a repository admin.
AUTOMERGE_TOKENis a fine-grained PAT scoped to this repository with Contents: read and write + Pull requests: read and write.This clears only the review requirement. Auto-merge still waits for the required checks (
build-test,validate-game-data), so a red build blocks the merge exactly as before.Action required before this takes effect
Create the PAT and save it as the repository secret
AUTOMERGE_TOKEN. Until then the workflow warns and Dependabot PRs need a manual merge — the same position as today, minus the silent failure.Verification
actionlint1.7.12 is clean on this workflow and on every other workflow in.github/workflows/. The runtime path cannot be exercised until the secret exists and Dependabot opens its next PR; the first real run is worth a look, in particular that thevalidate-game-datarequired check — which reportsskippingon dependency-only PRs — is treated as satisfied by auto-merge.No issue filed, per instruction.