From 4a03328b330d6f9f3c9c771ac6ceac8b8e963873 Mon Sep 17 00:00:00 2001 From: S4NKALP Date: Fri, 6 Mar 2026 19:40:50 +0545 Subject: [PATCH] =?UTF-8?q?feat(.github/workflows):=20enable=20dependabot?= =?UTF-8?q?=20auto=E2=80=91merge=20for=20minor=20updates?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Switch trigger to `pull_request_target` with `opened`, `synchronize`, and `reopened` events for safer automation - Add explicit check that the actor is `dependabot[bot]` to prevent unintended executions - Use `GITHUB_TOKEN` instead of a dedicated secret and enable `use-github-auto-merge` for automatic merging of minor updates --- .github/workflows/dependabot-auto-merge.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index b269dc4..1310170 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -1,7 +1,8 @@ name: Dependabot Auto-Merge on: - pull_request: + pull_request_target: + types: [opened, synchronize, reopened] permissions: contents: write @@ -9,11 +10,13 @@ permissions: jobs: dependabot: - if: github.actor == 'dependabot[bot]' runs-on: ubuntu-latest - + # Check that it's actually dependabot + if: github.event.pull_request.user.login == 'dependabot[bot]' steps: - name: Merge PR from Dependabot uses: fastify/github-action-merge-dependabot@v3 with: - github-token: ${{ secrets.DEPENDABOT_TOKEN }} + github-token: ${{ secrets.GITHUB_TOKEN }} + use-github-auto-merge: true + target: minor