Conversation
Agent-Logs-Url: https://github.com/USTC-KnowledgeComputingLab/ds/sessions/bde5e7de-b535-4e83-81de-05595cc8710f Co-authored-by: hzhangxyz <11623447+hzhangxyz@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to automatically enable GitHub’s native auto-merge for Dependabot PRs once required checks pass, reducing manual maintenance overhead.
Changes:
- Introduces
.github/workflows/dependabot.ymlworkflow triggered on PR events. - Uses
gh pr merge --auto --squashto enable auto-merge on qualifying PRs. - Grants workflow-level
contents: writeandpull-requests: writepermissions to allow merging.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| jobs: | ||
| dependabot: | ||
| runs-on: ubuntu-latest | ||
| if: github.actor == 'dependabot[bot]' |
There was a problem hiding this comment.
The job gating uses github.actor == 'dependabot[bot]', which depends on who triggered the event rather than who owns the PR. If a Dependabot-authored PR is updated or re-run by a maintainer, github.actor may no longer be dependabot[bot], and auto-merge won’t be (re)enabled. Prefer checking the PR author instead (e.g., github.event.pull_request.user.login == 'dependabot[bot]').
| if: github.actor == 'dependabot[bot]' | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' |
| pull-requests: write | ||
|
|
||
| on: | ||
| - pull_request |
There was a problem hiding this comment.
on: pull_request without specifying types runs on all PR activity (including closed). Dependabot can close its own PRs (e.g., superseded updates), and gh pr merge --auto will fail/no-op on closed PRs, creating noisy failing workflow runs. Consider restricting trigger types (e.g., opened, reopened, synchronize, ready_for_review) and/or adding an if: guard that the PR state is open.
| - pull_request | |
| pull_request: | |
| types: | |
| - opened | |
| - reopened | |
| - synchronize | |
| - ready_for_review |
Dependabot PRs with all checks passing should be merged automatically without manual intervention.
Changes
.github/workflows/dependabot.yml: triggers onpull_request, skips non-Dependabot actors, and callsgh pr merge --auto --squashto enable GitHub's native auto-merge — the merge fires only after all required status checks passRequires
contents: writeandpull-requests: writepermissions. Style follows existing workflows (on:list notation, same job structure).