ci(dependabot): automate merge flow for dependency PRs (#201) by mpaulosky · Pull Request #202 · mpaulosky/MyBlog

mpaulosky · 2026-04-26T17:42:11Z

Closes #201

Changes

add a dedicated Dependabot auto-merge workflow for PRs targeting dev
enable auto-merge when Dependabot opens or updates eligible PRs
refresh open Dependabot PR branches after dev advances and re-assert auto-merge
keep existing branch protection and status check rules intact

Testing

actionlint .github/workflows/dependabot-auto-merge.yml
dotnet build MyBlog.slnx --configuration Release
dotnet test tests/Domain.Tests/Domain.Tests.csproj --configuration Release --no-build

Checklist

Code follows conventions
Tests added/updated
Documentation updated (if needed)

The refresh-open-prs job previously only called updateBranch. PRs opened before this workflow existed, or PRs where the enable-auto-merge job failed transiently, would be refreshed but auto-merge would never be enabled for them. Add enablePullRequestAutoMerge to the refresh loop so a workflow_dispatch or any push to dev fully recovers stuck PRs. Failures are core.warning (not throw) — branch refresh remains the primary purpose. Closes #201 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-26T17:42:20Z

🏗️ PR Added to Squad Triage Queue

This PR has been labeled with squad and added to the triage queue.

Next steps:

The squad Lead will review and assign to an appropriate team member
A squad:member label will be added after triage

If you know which squad member should handle this, you can add the appropriate squad:member label yourself.

Copilot

Pull request overview

Adds a dedicated GitHub Actions workflow to automatically enable and re-assert auto-merge for Dependabot PRs targeting dev, and to refresh Dependabot PR branches when dev advances so they can reach a green/mergeable state without manual intervention.

Changes:

Introduces dependabot-auto-merge.yml with a pull_request_target job to enable auto-merge on eligible Dependabot PRs.
Adds a push-triggered job to update/refresh open Dependabot PR branches after dev moves forward and re-enable auto-merge.

Copilot · 2026-04-26T17:44:21Z

+
+    steps:
+      - name: Enable auto-merge
+        uses: actions/github-script@v8


This workflow uses actions/github-script@v8, but other repo workflows are already on actions/github-script@v9. Bumping to the same major version keeps action security fixes and behavior consistent across workflows.

Suggested change

uses: actions/github-script@v8

uses: actions/github-script@v9

Copilot · 2026-04-26T17:44:22Z

+      - name: Update open Dependabot PRs
+        uses: actions/github-script@v8
+        with:


This workflow uses actions/github-script@v8, but other repo workflows are already on actions/github-script@v9. Bumping to the same major version keeps action security fixes and behavior consistent across workflows.

Copilot · 2026-04-26T17:44:22Z

+permissions:
+  contents: write
+  pull-requests: write
+


Workflow-level permissions grant contents: write and pull-requests: write for all triggers (including pull_request_target). To reduce blast radius, consider setting default permissions to read-only and granting write permissions at the job level only where needed (e.g., enable-auto-merge likely only needs pull-requests: write).

github-actions · 2026-04-26T17:45:46Z

Test Results Summary

273 tests ±0 273 ✅ ±0 16s ⏱️ ±0s
6 suites ±0 0 💤 ±0
6 files ±0 0 ❌ ±0

Results for commit 03bddc3. ± Comparison against base commit 5e8e658.

♻️ This comment has been updated with latest results.

codecov · 2026-04-26T17:46:00Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.64%. Comparing base (5e8e658) to head (03bddc3).
⚠️ Report is 1 commits behind head on sprint/12-xunit-v3-apphost-tests.

Additional details and impacted files

@@                        Coverage Diff                        @@
##           sprint/12-xunit-v3-apphost-tests     #202   +/-   ##
=================================================================
  Coverage                             78.64%   78.64%           
=================================================================
  Files                                    43       43           
  Lines                                   721      721           
  Branches                                112      112           
=================================================================
  Hits                                    567      567           
  Misses                                  108      108           
  Partials                                 46       46

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

mpaulosky · 2026-04-26T18:06:42Z

🔄 CHANGES_REQUESTED — Routing fix cycle

Ralph pre-review gate found one substantive workflow issue to fix before final review approval:

Pin the enablePullRequestAutoMerge GraphQL mutation to an explicit merge method instead of inheriting the repository default implicitly.

Accepted fix path: set mergeMethod: SQUASH in both auto-merge mutation calls.

Note: the review concern about dev-only targeting is intentional for this repo because .github/dependabot.yml targets dev; this workflow is meant to become active after the sprint branch merges forward.

Routed to: Boromir (DevOps / Infra)
Fix will be pushed to squad/201-dependabot-auto-merge-labels and re-validated.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

mpaulosky · 2026-04-26T18:08:46Z

✅ Fix pushed in 03bddc3.

Pinned mergeMethod: SQUASH in both enablePullRequestAutoMerge mutation calls.
Local pre-push gates passed and the branch is updated on GitHub.
PR ci(dependabot): automate merge flow for dependency PRs (#201) #202 is now rerunning CI on the new head SHA and Ralph will resume the review gate once checks settle.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

Copilot · 2026-04-26T18:22:37Z

+      - name: Update open Dependabot PRs
+        uses: actions/github-script@v8
+        with:


This step also uses actions/github-script@v8; the repo standardizes on actions/github-script@v9. Please bump to v9 for consistency across workflows.

Copilot · 2026-04-26T18:22:37Z

+              if (message.includes('already enabled')) {
+                core.info(`Auto-merge is already enabled for PR #${pullNumber}.`);


In enable-auto-merge, the catch block only handles the "already enabled" case; all other GraphQL errors will fail the workflow run and leave a red check on the PR. Consider treating expected/non-actionable states (e.g., temporarily not mergeable / branch behind) as info/warning and exiting cleanly (similar to the refresh job) so this automation doesn’t create noisy failures.

Suggested change

if (message.includes('already enabled')) {

core.info(`Auto-merge is already enabled for PR #${pullNumber}.`);

const normalizedMessage = message.toLowerCase();

const nonActionableStates = [

{

match: 'already enabled',

log: () => core.info(`Auto-merge is already enabled for PR #${pullNumber}.`),

},

{

match: 'not in the correct state to enable auto-merge',

log: () =>

core.warning(

`Auto-merge cannot be enabled for PR #${pullNumber} yet because the PR is not currently mergeable.`

),

},

{

match: 'pull request is in clean status',

log: () =>

core.warning(

`Auto-merge cannot be enabled for PR #${pullNumber} yet because the branch is not up to date or merge requirements are still pending.`

),

},

{

match: 'head branch was modified',

log: () =>

core.warning(

`Auto-merge could not be enabled for PR #${pullNumber} because the head branch changed during evaluation.`

),

},

{

match: 'base branch was modified',

log: () =>

core.warning(

`Auto-merge could not be enabled for PR #${pullNumber} because the base branch changed during evaluation.`

),

},

{

match: 'is behind the base branch',

log: () =>

core.warning(

`Auto-merge cannot be enabled for PR #${pullNumber} yet because the branch is behind the base branch.`

),

},

{

match: 'required status check',

log: () =>

core.warning(

`Auto-merge cannot be enabled for PR #${pullNumber} yet because required status checks have not completed successfully.`

),

},

];

const handledState = nonActionableStates.find(({ match }) =>

normalizedMessage.includes(match)

);

if (handledState) {

handledState.log();

- promote Sprint 12 from sprint/12-xunit-v3-apphost-tests into dev - add the Dependabot auto-merge workflow validated in PR #202 - complete Sprint 12 milestone closeout Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 26, 2026 17:42

github-actions Bot added the squad Squad triage inbox — Lead will assign to a member label Apr 26, 2026

Copilot started reviewing on behalf of mpaulosky April 26, 2026 17:42 View session

Copilot AI reviewed Apr 26, 2026

View reviewed changes

fix(ci): pin dependabot auto-merge method

03bddc3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

mpaulosky requested a review from Copilot April 26, 2026 18:19

Copilot started reviewing on behalf of mpaulosky April 26, 2026 18:19 View session

mpaulosky merged commit 36d9aad into sprint/12-xunit-v3-apphost-tests Apr 26, 2026
17 checks passed

mpaulosky deleted the squad/201-dependabot-auto-merge-labels branch April 26, 2026 18:20

mpaulosky mentioned this pull request Apr 26, 2026

[Sprint 12] Automate Dependabot dependency merges and add missing labels #201

Closed

5 tasks

Copilot AI reviewed Apr 26, 2026

View reviewed changes

mpaulosky mentioned this pull request Apr 26, 2026

sprint(12): merge Sprint 12 — xUnit v3 (AppHost.Tests) #203

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(dependabot): automate merge flow for dependency PRs (#201)#202

ci(dependabot): automate merge flow for dependency PRs (#201)#202
mpaulosky merged 2 commits into
sprint/12-xunit-v3-apphost-testsfrom
squad/201-dependabot-auto-merge-labels

mpaulosky commented Apr 26, 2026

Uh oh!

github-actions Bot commented Apr 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

github-actions Bot commented Apr 26, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Apr 26, 2026 •

edited

Loading

Uh oh!

mpaulosky commented Apr 26, 2026

Uh oh!

mpaulosky commented Apr 26, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

Copilot AI Apr 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: actions/github-script@v8
	uses: actions/github-script@v9

		if (message.includes('already enabled')) {
		core.info(`Auto-merge is already enabled for PR #${pullNumber}.`);

-              if (message.includes('already enabled')) {
-                core.info(`Auto-merge is already enabled for PR #${pullNumber}.`);
+              const normalizedMessage = message.toLowerCase();
+              const nonActionableStates = [
+                {
+                  match: 'already enabled',
+                  log: () => core.info(`Auto-merge is already enabled for PR #${pullNumber}.`),
+                },
+                {
+                  match: 'not in the correct state to enable auto-merge',
+                  log: () =>
+                    core.warning(
+                      `Auto-merge cannot be enabled for PR #${pullNumber} yet because the PR is not currently mergeable.`
+                    ),
+                },
+                {
+                  match: 'pull request is in clean status',
+                  log: () =>
+                    core.warning(
+                      `Auto-merge cannot be enabled for PR #${pullNumber} yet because the branch is not up to date or merge requirements are still pending.`
+                    ),
+                },
+                {
+                  match: 'head branch was modified',
+                  log: () =>
+                    core.warning(
+                      `Auto-merge could not be enabled for PR #${pullNumber} because the head branch changed during evaluation.`
+                    ),
+                },
+                {
+                  match: 'base branch was modified',
+                  log: () =>
+                    core.warning(
+                      `Auto-merge could not be enabled for PR #${pullNumber} because the base branch changed during evaluation.`
+                    ),
+                },
+                {
+                  match: 'is behind the base branch',
+                  log: () =>
+                    core.warning(
+                      `Auto-merge cannot be enabled for PR #${pullNumber} yet because the branch is behind the base branch.`
+                    ),
+                },
+                {
+                  match: 'required status check',
+                  log: () =>
+                    core.warning(
+                      `Auto-merge cannot be enabled for PR #${pullNumber} yet because required status checks have not completed successfully.`
+                    ),
+                },
+              ];
+              const handledState = nonActionableStates.find(({ match }) =>
+                normalizedMessage.includes(match)
+              );
+              if (handledState) {
+                handledState.log();

Conversation

mpaulosky commented Apr 26, 2026

Changes

Testing

Checklist

Uh oh!

github-actions Bot commented Apr 26, 2026

🏗️ PR Added to Squad Triage Queue

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results Summary

Uh oh!

codecov Bot commented Apr 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

mpaulosky commented Apr 26, 2026

Uh oh!

mpaulosky commented Apr 26, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Apr 26, 2026 •

edited

Loading

codecov Bot commented Apr 26, 2026 •

edited

Loading