[loks0n]

26 repos in appwrite and appwrite-labs carry their own dependabot-auto-merge.yml, in five versions. None of them is merging anything: 0 Dependabot PRs merged by a bot in the last 30 days across all 26, with 266 open.

This adds one reusable workflow that each repo calls from a workflow_run: completed trigger. Because workflow_run runs the default branch's copy, a PR can't change the code that decides to approve it.

For a Dependabot PR at an exact head SHA it:

1. Leaves majors and anything without update metadata for a human.
2. Waits for every other check run and commit status on that SHA, up to 40 minutes, and stops if any isn't success, neutral or skipped. That covers path-filtered and per-template jobs with no per-repo list of check names.
3. Approves at that SHA, then merges with --match-head-commit.

It merges directly instead of through GitHub auto-merge, because the checks have already passed by then. That means repos don't need Allow auto-merge or required status checks.

The callers come in follow-up PRs, one per repo, pinned to this commit.

🤖 Generated with Claude Code

[hansi-codes]

🟢 Tier S · Ready to merge

The added workflow-run polling addresses the previously reported gap for queued workflows, and I found no new defects in these commits.

Adds a reusable workflow that approves and merges eligible Dependabot patch and minor pull requests after checks pass on the exact head SHA. It identifies updates from Dependabot commit metadata, waits for workflow runs, check runs, and commit statuses, then approves and merges with a head-SHA match.

Latest changes: The latest commits add polling of workflow runs so queued runs are included while waiting for checks on the pull-request SHA.

Verdict	New comments	Fixed	Still open
✅ Approved	0	1	0

📂 Walkthrough · 1

File	Change
.github/workflows/dependabot-auto-merge.yml	Adds a reusable Dependabot approval-and-merge workflow that waits for workflow runs, check runs, and commit statuses on the exact head SHA.

✅ Fixed since the last review · 1

• Wait for checks that have not been created yet · .github/workflows/dependabot-auto-merge.yml:82

---

_{Reviewed the commits since cb03552 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary

[loks0n]

Rollout notes. This replaces the admin plan in the "Dependabot auto-merge: admin fixes" doc.

What changed from the doc

• appwrite is on the Free plan, so org rulesets aren't available (API returns "Upgrade to GitHub Team"). This gate checks CI itself, so no required-check rulesets are needed.
• appwrite already allows Actions to approve PRs. Only appwrite-labs needs the setting.
• The gate merges directly, so repos don't need Allow auto-merge.
• Four sidecars (runtime-build, runtime-init, database-metrics, wal-sync) had no patch/minor filter and would have merged majors once approvals were allowed. The PRs below fix that.

Caller PRs (shared gate + 7-day cooldown)

• https://github.com/appwrite-labs/assets/pull/30
• https://github.com/appwrite-labs/og-image/pull/12
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown appwrite-labs/php-k8s#40
• https://github.com/appwrite-labs/sidecar-for-database-metrics/pull/39
• https://github.com/appwrite-labs/sidecar-for-runtime-build/pull/6
• https://github.com/appwrite-labs/sidecar-for-runtime-init/pull/8
• https://github.com/appwrite-labs/sidecar-for-sql-api/pull/48
• https://github.com/appwrite-labs/sidecar-for-wal-sync/pull/15
• https://github.com/appwrite-labs/threads/pull/26
• https://github.com/appwrite-labs/uptime-monitors/pull/27
• ci: use the shared Dependabot auto-merge gate appwrite#15061
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown builtwith#76
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown playground-for-web#141
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-analog#18
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-angular#19
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-astro#15
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-js#12
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-nextjs#28
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-nuxt#10
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-react-native#24
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-react#23
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-remix#10
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-svelte#21
• ci: use the shared Dependabot auto-merge gate, add a 7-day cooldown starter-for-vue#15
• ci: use the shared Dependabot auto-merge gate templates-for-sites#66
• ci: use the shared Dependabot auto-merge gate templates#475

Ops still to do

1. Merge the sidecar PRs first, then turn on Actions approval in appwrite-labs: gh api -X PUT orgs/appwrite-labs/actions/permissions/workflow -F can_approve_pull_request_reviews=true
2. Old Dependabot PRs whose head has a failed run of the old Dependabot auto-merge workflow (e.g. php-k8s) will be blocked until Dependabot rebases them. Comment @dependabot rebase on those.

What to watch after merge

• Bot merge counts: gh pr list -R <repo> --author app/dependabot --state merged --search 'merged:>2026-10-28'
• Dependabot PRs that touch .github/workflows (github-actions ecosystem). Not verified that GITHUB_TOKEN can merge those. If the merge step fails on them, they stay open for a human.

[loks0n]

Status 2026-10-28 14:00 UTC

• Merged (18): assets, og-image, threads, uptime-monitors, playground-for-web, all 12 starters, templates-for-sites. Also docs: list actions: read in the Dependabot gate's usage example #133.
• Approved, waiting on a merge: ci: use the shared Dependabot auto-merge gate appwrite#15061, sidecar-for-runtime-build#6, sidecar-for-runtime-init#8, sidecar-for-wal-sync#15, templates#475, builtwith#76. The last two have failing checks that also fail on main or on Dependabot's own PRs.
• Blocked on the required Coverage check: sidecar-for-database-metrics#39 and sidecar-for-sql-api#48. The Mongo test container won't start on the runner's 6.19 kernel ("MongoDB cannot start: Linux kernel versions 6.19 and newer..."). sql-api main fails the same way. This needs an admin merge or a Mongo image fix.
• php-k8s#40: waiting on CI.
• Org setting still off in appwrite-labs. Turn it on only after database-metrics, runtime-build, runtime-init and wal-sync have merged, because their old gates approve majors.
• Not tested end to end yet. The open backlog in the merged repos is almost all majors. The only patch PR (playground-for-web#92) was closed by Dependabot as obsolete. The first real run will be the next weekly Dependabot update.

[loks0n]

Update: merged appwrite#15061, sidecar-for-runtime-build#6, sidecar-for-runtime-init#8, sidecar-for-wal-sync#15, templates#475, builtwith#76. That's 24 of 26. Still open: sidecar-for-database-metrics#39 and sidecar-for-sql-api#48 (the Mongo/6.19 Coverage failure), and php-k8s#40 (CI). The appwrite-labs approval setting stays off until database-metrics merges.

[loks0n]

Done: all 26 callers merged. database-metrics#39 and sql-api#48 were admin-merged past the Mongo/6.19 Coverage failure. Actions approval is on in appwrite-labs: org setting plus a repo override on threads.

Verified end to end: og-image#10, a minor group bump, was approved and merged by github-actions at 14:21 UTC. Before approvals were on, the same run reached the approve step and got a 422, as expected.

Watch next:

• Merges by github-actions on the next weekly Dependabot run.
• Any github-actions-ecosystem PR (one that changes .github/workflows): it's still unverified whether GITHUB_TOKEN can merge it.
• sql-api and database-metrics stay blocked until the Mongo test runs on kernel 6.19.