From 8b8856fc3be5cfb9ddbabb3114706469453f1a4d Mon Sep 17 00:00:00 2001 From: Gil Desmarais Date: Sun, 3 May 2026 16:23:37 +0200 Subject: [PATCH 1/2] ci(security): restrict dependabot automerge to patch and minor updates --- .github/workflows/dependabot-automerge.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 1257739..82b846a 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -10,7 +10,16 @@ jobs: runs-on: ubuntu-latest if: github.actor == 'dependabot[bot]' steps: - - name: Enable automerge for Dependabot PRs + - name: Fetch Dependabot Metadata + id: metadata + uses: dependabot/fetch-metadata@v2 + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" + + - name: Enable automerge for Patch and Minor updates + if: | + steps.metadata.outputs.update-type == 'version-update:semver-patch' || + steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --merge "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} From 713ae5481b494ceb9f148351f2dc573d29466332 Mon Sep 17 00:00:00 2001 From: Gil Desmarais Date: Sun, 3 May 2026 16:28:17 +0200 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .github/workflows/dependabot-automerge.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 82b846a..0cd034b 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -16,10 +16,11 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" - - name: Enable automerge for Patch and Minor updates + - name: Enable automerge for Patch, Minor, and Security updates if: | steps.metadata.outputs.update-type == 'version-update:semver-patch' || - steps.metadata.outputs.update-type == 'version-update:semver-minor' + steps.metadata.outputs.update-type == 'version-update:semver-minor' || + steps.metadata.outputs.update-type == 'security-update' run: gh pr merge --auto --merge "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }}