Repository navigation
feat(dependabot): merge every Dependabot PR through the all-checks gate - #206
Merged
Merged
Conversation
Andrew decided on 2026-10-25 that no human approves Dependabot updates (dev-env#229). v2 merged patch/minor with --auto, which waits on required checks only, and skipped untrusted majors and groups with a notice nobody saw. Every PR with dependency names now goes through the gate: wait for every check on the head to finish green, then merge with --match-head-commit. The deadline is 60 minutes (job timeout 70). A PR the gate does not merge gets dependabot-blocked plus one reason label: red-check, main-red (every failing check also fails on the base branch), timeout, no-checks, cannot-evaluate or merge-failed. The digest reads them. A later merge clears them. Label calls degrade to a warning, so the run is never red (#87). trusted_namespaces and allow_major are accepted and ignored for one release. Callers stay on v2 until the v3 tag is cut and a canary passes. Advances #203
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Andrew decided on 2026-10-25 that no human approves Dependabot updates (smartwatermelon/dev-env#229). v2 merged patch/minor with
--auto, which waits on required checks only, and skipped untrusted majors and groups with a notice nobody saw.Change
--match-head-commit. Deadline 60 minutes, job timeout 70.dependabot-blockedplus one reason label:red-check,main-red,timeout,no-checks,cannot-evaluate,merge-failed. A later merge clears them. Label calls degrade to a warning, so the run is never red (dependabot-auto-merge is inert in 29/51 fleet repos: can_approve_pull_request_reviews unset by installer #87).main-redmeans every failing check also fails on the base branch head. If the base branch cannot be read, the label isred-check.trusted_namespacesandallow_majorare accepted and ignored for one release.Decisions from dev-env#229: short cooldown kept (README says so), all-checks gate, new
v3tag with a canary first.Not in this PR
dependabot-auto-merge-v3.0.0and-v3: Andrew cuts them after merge.projectinsomnia, pinned to-v3.0.0), then the fleet.GITHUB_TOKEN.Tests
tests/test-dependabot-auto-merge.sh: 31 pass. Covers main-red vs red-check, unreadable head, all-skipped checks, merge failure, stale label cleanup.Advances #203