From ecf329abe1f04f93c0e202c75d042115c28a013a Mon Sep 17 00:00:00 2001 From: WhiteMuush Date: Tue, 4 Aug 2026 19:50:25 +0200 Subject: [PATCH] ci(deps): drop Dependabot auto-merge Auto-merge was there to absorb volume, back when Dependabot opened about thirteen pull requests a month. Grouping them by ecosystem and by semver impact brought that down to three, so the saving is now marginal while the risk is unchanged. A patch bump can still carry a breaking change that the smoke-level e2e does not reach, and npm ci runs install scripts inside the runner before the merge rather than after. Dependabot also targets main, the production branch, so a bot merge there would be looser than the review this repo now requires on develop. Three pull requests a month read in minutes. Keep the human in the loop on the only code entering the repository from outside. Removes the workflow, so allow_auto_merge no longer needs enabling. --- .github/dependabot.yml | 7 ++-- .github/workflows/dependabot-automerge.yml | 42 ---------------------- 2 files changed, 4 insertions(+), 45 deletions(-) delete mode 100644 .github/workflows/dependabot-automerge.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 49779a2..8a20756 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -26,9 +26,10 @@ updates: update-types: ["version-update:semver-major"] - dependency-name: "eslint" update-types: ["version-update:semver-major"] - # Split by semver impact, not by prod/dev. Patches are safe enough to flow - # continuously; minors and majors are held for review so the dependency - # state is known when a release tag is cut. + # Split by semver impact, not by prod/dev. Patches carry their own low-risk + # pull request that reviews in a glance; minors and majors are isolated so + # the dependency state is known when a release tag is cut. Every bump is + # merged by a human, see the note on the cooldown above. commit-message: prefix: "build" prefix-development: "chore" diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml deleted file mode 100644 index 2b7670c..0000000 --- a/.github/workflows/dependabot-automerge.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Dependabot auto-merge - -# Patch bumps are merged without human review, but only after two independent -# gates: the dependabot.yml cooldown means the release is at least 7 days old, -# and --auto holds the merge until the required "ci" check passes. The "ci" job -# aggregates quality, test, build, integration and e2e, so nothing slips in on a -# partial run. Minor and major bumps stay manual by design. - -on: pull_request - -# Least privilege by default for every job in this workflow. -permissions: - contents: read - -concurrency: - group: dependabot-automerge-${{ github.ref }} - cancel-in-progress: true - -jobs: - automerge: - name: Auto-merge patch updates - runs-on: ubuntu-latest - timeout-minutes: 5 - if: github.actor == 'dependabot[bot]' - permissions: - contents: write - pull-requests: write - steps: - - name: Fetch Dependabot metadata - id: metadata - uses: dependabot/fetch-metadata@v2 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - - # A grouped pull request reports the highest bump it contains, so the - # npm-patch group only ever resolves to semver-patch here. - - name: Enable auto-merge for patch updates - if: steps.metadata.outputs.update-type == 'version-update:semver-patch' - run: gh pr merge --auto --squash "$PR_URL" - env: - PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}