Problem
Dependabot PRs that bump dev-only or transitive dependencies at patch level (e.g. #4904, a lockfile-only bump of fast-uri, a transitive dep of babel-loader) require manual review and merging, but carry effectively zero risk: they never ship to production, cannot change any API we code against, and are gated by CI.
Proposal
Add a dependabot-auto-merge workflow that, for Dependabot PRs only:
- Reads update metadata via
dependabot/fetch-metadata.
- If the update is
version-update:semver-patch and the dependency type is direct:development or indirect, approves the PR and enables GitHub auto-merge (squash).
All other Dependabot PRs (runtime deps, minor/major bumps) remain manual.
Required repo settings (admin)
- Enable Allow auto-merge in repo settings (currently off).
- Add
build (the run-checks job) as a required status check on main — currently there are none, so auto-merge would not wait for CI.
Related observation (out of scope, needs a decision)
.github/dependabot.yml points version updates at directory: "/spa", which no longer exists — so scheduled version updates are silently dead and only security PRs are being opened. Re-pointing it to "/" would revive version updates but may open a large batch of PRs (limit is 50). Left for a separate issue/decision.
Problem
Dependabot PRs that bump dev-only or transitive dependencies at patch level (e.g. #4904, a lockfile-only bump of
fast-uri, a transitive dep ofbabel-loader) require manual review and merging, but carry effectively zero risk: they never ship to production, cannot change any API we code against, and are gated by CI.Proposal
Add a
dependabot-auto-mergeworkflow that, for Dependabot PRs only:dependabot/fetch-metadata.version-update:semver-patchand the dependency type isdirect:developmentorindirect, approves the PR and enables GitHub auto-merge (squash).All other Dependabot PRs (runtime deps, minor/major bumps) remain manual.
Required repo settings (admin)
build(therun-checksjob) as a required status check onmain— currently there are none, so auto-merge would not wait for CI.Related observation (out of scope, needs a decision)
.github/dependabot.ymlpoints version updates atdirectory: "/spa", which no longer exists — so scheduled version updates are silently dead and only security PRs are being opened. Re-pointing it to"/"would revive version updates but may open a large batch of PRs (limit is 50). Left for a separate issue/decision.