From 0a13c4a9bcb5484aec7262e5ba1260dd80ace169 Mon Sep 17 00:00:00 2001 From: Cursor Date: Thu, 3 Sep 2026 22:20:18 +0000 Subject: [PATCH 1/4] Approve and auto-merge non-major Dependabot PRs Branch protection requires reviews, so enabling auto-merge alone left Dependabot PRs blocked. Restore approval, keep major updates for human review, and match on the PR author so branch updates still trigger. Co-authored-by: ProxyMesh AI --- .github/workflows/dependabot-auto-merge.yml | 38 ++++++++++++++++++--- 1 file changed, 34 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index eaafb2b..459b723 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -1,18 +1,48 @@ +# Approve Dependabot pull requests and enable auto-merge so GitHub merges them once +# required status checks pass. Requires: +# - Settings → General → Pull Requests → Allow auto-merge +# - Settings → Actions → General → Allow GitHub Actions to create and approve pull requests +# - Branch protection required status checks (reviews are satisfied by this workflow) +# See: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions +# +# Major version updates are left for human review (matches Dependabot grouping policy). + name: dependabot-auto-merge + on: - pull_request_target + pull_request_target: + permissions: contents: write pull-requests: write + jobs: automerge: - if: github.actor == 'dependabot[bot]' + # Key off the PR author so synchronize events from branch updates still run. + if: github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest steps: - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0 id: meta - - if: steps.meta.outputs.update-type != 'version-update:semver-major' - run: gh pr merge --auto --squash "$PR" + + - name: Approve pull request + if: steps.meta.outputs.update-type != 'version-update:semver-major' + run: | + set -euo pipefail + if [ "$(gh pr view "$PR" --json reviewDecision -q .reviewDecision)" != "APPROVED" ]; then + gh pr review --approve "$PR" + fi + env: + PR: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto-merge + if: steps.meta.outputs.update-type != 'version-update:semver-major' + run: | + set -euo pipefail + if [ "$(gh pr view "$PR" --json autoMergeRequest -q '.autoMergeRequest != null')" != "true" ]; then + gh pr merge --auto --squash "$PR" + fi env: PR: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 34ea119f9ab1289ebe016e7354602f067671f6cf Mon Sep 17 00:00:00 2001 From: Cursor Date: Thu, 3 Sep 2026 22:42:54 +0000 Subject: [PATCH 2/4] Fail closed when Dependabot update-type is missing After a human branch update, fetch-metadata can leave update-type empty if commit verification fails, and != semver-major would still approve. Skip commit verification for merge commits, and only auto-approve/merge explicit minor or patch updates. Co-authored-by: ProxyMesh AI --- .github/workflows/dependabot-auto-merge.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 459b723..a7dfd5e 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -24,9 +24,14 @@ jobs: steps: - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0 id: meta + with: + # Branch updates add non-Dependabot merge commits; still parse Dependabot metadata. + skip-commit-verification: true + # Fail closed: only allowlisted minor/patch types. Empty/unknown update-type must not + # approve or merge (e.g. if metadata is missing after an unusual branch history). - name: Approve pull request - if: steps.meta.outputs.update-type != 'version-update:semver-major' + if: contains(fromJSON('["version-update:semver-minor","version-update:semver-patch"]'), steps.meta.outputs.update-type) run: | set -euo pipefail if [ "$(gh pr view "$PR" --json reviewDecision -q .reviewDecision)" != "APPROVED" ]; then @@ -37,7 +42,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Enable auto-merge - if: steps.meta.outputs.update-type != 'version-update:semver-major' + if: contains(fromJSON('["version-update:semver-minor","version-update:semver-patch"]'), steps.meta.outputs.update-type) run: | set -euo pipefail if [ "$(gh pr view "$PR" --json autoMergeRequest -q '.autoMergeRequest != null')" != "true" ]; then From 1f95fe3e5e6312ef0e431fdd52501464a94c0f36 Mon Sep 17 00:00:00 2001 From: Cursor Date: Thu, 3 Sep 2026 22:48:00 +0000 Subject: [PATCH 3/4] Trigger Bugbot and security review re-run Co-authored-by: ProxyMesh AI From 634ffe8a6c4bab720d7b6c342cfb5bc7ce4b91c8 Mon Sep 17 00:00:00 2001 From: Cursor Date: Thu, 3 Sep 2026 22:53:50 +0000 Subject: [PATCH 4/4] Harden Dependabot auto-merge job guards Restrict pull_request_target to opened/reopened/synchronize, require the head repo to match this repository, and note that steps only call the GitHub API (no PR code checkout). Co-authored-by: ProxyMesh AI --- .github/workflows/dependabot-auto-merge.yml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index a7dfd5e..490e982 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -11,6 +11,7 @@ name: dependabot-auto-merge on: pull_request_target: + types: [opened, reopened, synchronize] permissions: contents: write @@ -18,8 +19,11 @@ permissions: jobs: automerge: - # Key off the PR author so synchronize events from branch updates still run. - if: github.event.pull_request.user.login == 'dependabot[bot]' + # Same-repo Dependabot PRs only. Key off the PR author so synchronize events from + # branch updates (non-Dependabot merge commits) still run. + if: > + github.event.pull_request.user.login == 'dependabot[bot]' && + github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest steps: - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0 @@ -30,6 +34,7 @@ jobs: # Fail closed: only allowlisted minor/patch types. Empty/unknown update-type must not # approve or merge (e.g. if metadata is missing after an unusual branch history). + # Does not check out or execute PR code — only calls the GitHub API. - name: Approve pull request if: contains(fromJSON('["version-update:semver-minor","version-update:semver-patch"]'), steps.meta.outputs.update-type) run: |