dependabot-auto-merge: optional App token, fail-closed update-type gate - #19
Merged
Conversation
Auto-merge armed with GITHUB_TOKEN lands with its push event suppressed (GitHub's recursion guard), so a repo whose deploy runs `on: push` to the default branch builds nothing for that merge. Surveyed across the org on 2026-08-20: nine repos had silently accumulated undeployed commits on main this way — youmove 41, wemove-charity.eu 40, bankimporter 32, mep-data-manager 28, toolbox 22 — every one merged by app/github-actions. Accept optional `app-id` / `app-private-key` secrets and arm the merge with an App installation token instead, which emits a real push event. The secrets are optional and fall back to GITHUB_TOKEN, so existing callers are unaffected; the workflow warns in the run log when it falls back. Also make the update-type gate fail closed. `contains(allowed, update-type)` returned true whenever fetch-metadata produced no update-type, because every string contains the empty string — which would auto-merge a major. Match whole tokens and require a non-empty update-type, the same stance donation-form and donations-api take. This matters because dependabot.yml `ignore` rules cover version updates only: a security major does reach this workflow, and this gate is the only thing refusing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks the org-wide Dependabot policy work: this is the one change that
re-arms auto-merge everywhere, since all six consumers already pin
@v14.Why
A merge armed with
GITHUB_TOKENhas its push event suppressed by GitHub'srecursion guard, so a repo whose deploy runs
on: pushto the default branchbuilds nothing for that merge. The PR goes green and nothing ships.
Measured across the org on 2026-08-20 — commits sitting on
mainwith nocorresponding deploy run:
Control case: on
wemove.euthe two human pushes on 2026-08-17 bothtriggered
publish.yml; the three Dependabot merges after them triggerednothing. Every merged Dependabot PR shows
mergedBy: app/github-actions.What changed
Optional App credentials. New
app-id/app-private-keysecrets mint aninstallation token, whose merge emits a real push event. Both are optional and
fall back to
GITHUB_TOKEN, so existing callers keep working unchanged — theworkflow just warns in the run log when it falls back. Additive, hence v14.1.0
rather than a new major.
Fail-closed update-type gate.
contains(allowed, update-type)returnedtrue whenever
fetch-metadataproduced noupdate-type, because every stringcontains the empty string — which would auto-merge a major. Now matches whole
tokens and requires a non-empty update-type, the same stance donation-form and
donations-api already take.
This second one is not theoretical:
dependabot.ymlignorerules coverversion updates only, so a security major does reach this workflow, and
this gate is the only thing refusing it.
Consuming this
The App needs Contents, Pull requests and Workflows (read/write). Workflows
is easy to miss and not optional — Dependabot's
github-actionsPRs edit filesunder
.github/workflows/, and a token without it is refused when merging them.Rollback
Move the floating
v14tag back to022a3ed. Instant and org-wide.🤖 Generated with Claude Code