From 8fd3100fd4d8056fb4514d4f2b346e598cb6d01e Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Mon, 14 Sep 2026 07:16:24 -0500 Subject: [PATCH 1/2] ci: auto-merge green Dependabot PRs (minor/patch) Adds dependabot-auto-merge.yml: Dependabot PRs whose required checks all pass merge themselves (minor/patch; majors held). Uses only GITHUB_TOKEN, no PAT. "Allow auto-merge" is enabled on the repo. fetch-metadata is dependabot-owned (not covered by github_owned_allowed), so it is added to allowed-actions.txt and the selected-actions setting, as scripts/check-action-allowlist.ps1 requires. SHA-pinned. Co-Authored-By: Claude Opus 5 --- .github/allowed-actions.txt | 3 ++ .github/workflows/dependabot-auto-merge.yml | 35 +++++++++++++++++++++ 2 files changed, 38 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/allowed-actions.txt b/.github/allowed-actions.txt index 8112489..c5638ef 100644 --- a/.github/allowed-actions.txt +++ b/.github/allowed-actions.txt @@ -18,3 +18,6 @@ gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 azure/webapps-deploy@02a81bead70021f5284939794bcec79c271ab383 Azure/static-web-apps-deploy@1a947af9992250f3bc2e68ad0754c0b0c11566c9 + +# Reads Dependabot update metadata so dependabot-auto-merge.yml can hold major bumps. +dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..17c7e52 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,35 @@ +name: Dependabot auto-merge + +# Turns on GitHub's native auto-merge for Dependabot pull requests, so a PR whose +# every required status check passes merges itself instead of waiting for a human. +# Branch protection still fully gates the merge — nothing red lands, and required +# checks/reviews are still enforced. +# +# Scope: minor and patch updates only. Major bumps are left open for a human to read +# the changelog first. Uses only the automatic GITHUB_TOKEN — no PAT or extra secrets. +# Requires "Allow auto-merge" in Settings > General (enabled for this repo). +# +# dependabot/fetch-metadata is SHA-pinned and listed in .github/allowed-actions.txt +# plus the repository's selected-actions setting, as this repo's allowlist requires. + +on: pull_request + +permissions: + contents: write # enable auto-merge on the PR + pull-requests: write # required by gh pr merge + +jobs: + auto-merge: + if: github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - name: Fetch Dependabot metadata + id: meta + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + + - name: Enable auto-merge for non-major updates + if: steps.meta.outputs.update-type != 'version-update:semver-major' + run: gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 2b9add6de661f8be8d1a07576369d39ef8f455b0 Mon Sep 17 00:00:00 2001 From: bgard68 <30295154+bgard68@users.noreply.github.com> Date: Mon, 14 Sep 2026 07:26:19 -0500 Subject: [PATCH 2/2] ci: satisfy this repo's own workflow rules (GHA002/GHA003) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RepositoryWorkflowsTests scans the repo's own workflows with its own rule catalogue and the first version tripped two: GHA003 — job had no timeout-minutes; added timeout-minutes: 5. GHA002 — pull-requests: write was workflow-scoped, so it reached every job; moved it onto the one job that needs it and set the workflow default to contents: read. Also dropped contents: write, which enabling auto-merge does not require (the merge is performed later by GitHub). Verified locally: the full RepositoryWorkflowsTests theory passes, this file included. Co-Authored-By: Claude Opus 5 --- .github/workflows/dependabot-auto-merge.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 17c7e52..6627afd 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -14,14 +14,20 @@ name: Dependabot auto-merge on: pull_request +# Read-only by default; the one job that needs it grants itself the minimum below. permissions: - contents: write # enable auto-merge on the PR - pull-requests: write # required by gh pr merge + contents: read jobs: auto-merge: if: github.actor == 'dependabot[bot]' runs-on: ubuntu-latest + timeout-minutes: 5 + # Scoped to the job, not the workflow: enabling auto-merge is a pull-request + # write, and the merge itself is performed later by GitHub, so nothing here + # needs contents: write (least privilege — GHA002/GHA003). + permissions: + pull-requests: write steps: - name: Fetch Dependabot metadata id: meta