DEVOPS-8593: feat: auto-approve and auto-merge Dependabot PRs - #158
DEVOPS-8593: feat: auto-approve and auto-merge Dependabot PRs#158rharasani-sa wants to merge 1 commit into
Conversation
|
🤖 AI review — posted by automation, not a human |
towczarek-sa
left a comment
towczarek-sa
left a comment
There was a problem hiding this comment.
🤖 AI review — posted by automation, not a human
| - name: Approve the PR | ||
| PR_URL: ${{github.event.pull_request.html_url}} | ||
| GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} | ||
| - name: Second approval - golang deps only |
There was a problem hiding this comment.
🤖 master requires code-owner review, and CODEOWNERS grants that only to the three named maintainers. Neither github-actions[bot] nor the DevOps service account qualifies, so auto-merge stays blocked on "review required from code owners" and never completes. Add the service account to CODEOWNERS, or turn off require-code-owner-reviews on master.
| PR_URL: ${{github.event.pull_request.html_url}} | ||
| GITHUB_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }} | ||
| - name: Enable auto-merge | ||
| run: gh pr merge --auto --squash "$PR_URL" |
There was a problem hiding this comment.
🤖 master has no required status checks configured, so auto-merge fires as soon as the approvals land and a failing build or lint will not block it. The removed gh pr checks --watch step was the only CI gate. Mark the build and lint jobs as required checks on master before enabling this.
| statuses: read | ||
| actions: read | ||
| contents: read | ||
| if: ${{ github.actor == 'dependabot[bot]' }} |
There was a problem hiding this comment.
🤖 This checks only the actor, and the commit-author verification step is gone. master has dismiss-stale-reviews and require-last-push-approval both off, so a push to a Dependabot branch after the two bot approvals inherits them and auto-merges unreviewed. Restore the pull_request.user.login == 'dependabot[bot]' condition and enable dismiss-stale-reviews.
3 participants
Summary
Replaces the wait-and-approve workflow with the pattern ciam-core uses (their workflow): approve the Dependabot PR, add a second approval from the DevOps service account for Go module updates, and enable GitHub native auto-merge (squash). Auto-merge only completes once branch protection is satisfied, so no explicit check-watching is needed — this also sidesteps the
gh pr checkslimitations on Dependabot tokens entirely.Differences from ciam-core's version: the Slack failure notification is omitted (it targets a ciam team channel with their bot token).
Note: the second-approval step requires
GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1to be available to this repo as a Dependabot secret — since oauth2c is public, the org secret's visibility policy must include it.JIRA: https://secureauth.atlassian.net/browse/DEVOPS-8593