From 5433b4c8039f597c5a5fa2887e6ccf219e1e1e2b Mon Sep 17 00:00:00 2001 From: Bryce Boe Date: Wed, 12 Aug 2026 08:21:39 -0700 Subject: [PATCH] Auto-merge major GitHub Actions bumps Action major bumps are routine pin moves already gated by actionlint, zizmor, and CI. Holding them for manual review only added latency: setup-python v7, stale v11, and setup-uv v9 sat for nine days with all checks green. Majors in other ecosystems still require manual review. --- .github/workflows/dependabot_automerge.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot_automerge.yml b/.github/workflows/dependabot_automerge.yml index 9a82d9f..e836723 100644 --- a/.github/workflows/dependabot_automerge.yml +++ b/.github/workflows/dependabot_automerge.yml @@ -23,7 +23,11 @@ jobs: id: metadata uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 - name: Enable auto-merge - if: steps.metadata.outputs.update-type != 'version-update:semver-major' + # Major bumps are held for manual review, except for GitHub Actions, whose + # majors are routine pin moves that the workflow linters and CI already gate. + if: >- + steps.metadata.outputs.update-type != 'version-update:semver-major' + || steps.metadata.outputs.package-ecosystem == 'github_actions' env: GH_TOKEN: ${{ steps.app-token.outputs.token }} PR_URL: ${{ github.event.pull_request.html_url }}