fix(ci): approve Dependabot PRs so auto-merge can complete - #283
Merged
Conversation
#281 restored the queuing half of auto-merge but not the merging half. PR #282 proved it: every check green, statusCheckRollup SUCCESS, auto-merge enabled nine seconds after Dependabot opened it — and still BLOCKED, sitting at reviewDecision REVIEW_REQUIRED. The `main protection` ruleset requires a code-owner approval, and the assumption that a bypass actor could merge without one was wrong. Bypass applies only to an interactive merge performed by that actor (`gh pr merge --admin`); GitHub's auto-merge ignores bypass entirely and waits for every merge requirement, review included. Approving #282 by hand settled it — the queued merge completed on its own three seconds later, with no other change. Approve with AUTOMERGE_TOKEN before queuing the merge. CODEOWNERS makes @StuartMeeks the owner of every path, and GITHUB_TOKEN cannot stand in: the repository disallows Actions approvals and github-actions[bot] is not a code owner. The approval re-runs on `synchronize` because the ruleset dismisses stale reviews on push and requires the approval to follow the last push. Patch and minor bumps now merge without a human reading them. That is what auto-merge means here, but it is a real change in review posture, so the workflow header states it plainly. Majors still stop for review, and required checks are never bypassed — auto-merge continues to wait for build-test and validate-game-data. Also correct the header comment from #281, which described the bypass behaviour incorrectly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 AI-generated PR — Please review carefully.
Why
#281 restored the queuing half of auto-merge but not the merging half. #282 proved it in the wild: auto-merge enabled nine seconds after Dependabot opened the PR, every check green,
statusCheckRollup: SUCCESS— and stillBLOCKED, parked atreviewDecision: REVIEW_REQUIRED.The
main protectionruleset requires a code-owner approval, and #281's assumption that a ruleset bypass actor could merge without one was wrong. Bypass applies only to an interactive merge performed by that actor (gh pr merge --admin— which is how the earlier backlog got cleared). GitHub's auto-merge ignores bypass entirely and waits for every merge requirement, review included.Approving #282 by hand settled it: the already-queued merge completed on its own three seconds later, with nothing else changed.
2026-08-06T13:11:08Z2026-08-06T13:11:11ZWhat changed
Approve with
AUTOMERGE_TOKENbefore queuing the merge. CODEOWNERS makes @StuartMeeks the owner of every path, andGITHUB_TOKENcannot stand in — the repository disallows Actions approvals (can_approve_pull_request_reviews: false) andgithub-actions[bot]is not a code owner.The approval re-runs on
synchronize, because the ruleset setsdismiss_stale_reviews_on_pushandrequire_last_push_approval, so every Dependabot rebase needs a fresh one.Also corrects the header comment from #281, which described the bypass behaviour incorrectly.
Review posture — please confirm you want this
Once this lands, patch and minor bumps merge with nobody reading them. That is what auto-merge means under this ruleset and there's no way to engineer around it, but it is a genuine change rather than a side effect of fixing a bug, so it should be a deliberate choice. The workflow header states it plainly rather than burying it.
Unchanged: majors still stop for review, and required checks are never bypassed — auto-merge continues to wait for
build-testandvalidate-game-data, so a red build still blocks the merge.Verification
actionlint1.7.12 is clean on this workflow and on every other workflow in.github/workflows/.Worth noting it earned its keep here: the first draft of the approve step was invalid YAML — the
run:plain scalar contained"Automated approval: …", and the colon-space broke the parse, which would have disabled the entire workflow. It's a block scalar now.No issue filed, per instruction.