From 7cd432ec437b8b48f7d732054f05f29a8ddda0d1 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 06:04:30 +0000 Subject: [PATCH 1/3] Auto-merge Dependabot patch and minor updates Add a workflow that approves Dependabot PRs and enables auto-merge (squash) when the update is a semver patch or minor bump. Major updates are left for manual review. Group minor and patch updates per ecosystem so related bumps arrive in one PR instead of conflicting with each other. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01DJB71D4PQASW44W45J3vJg --- .github/dependabot.yml | 10 +++++++ .github/workflows/dependabot-automerge.yml | 32 ++++++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 .github/workflows/dependabot-automerge.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 145c53f..c8da652 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,7 +6,17 @@ updates: interval: daily time: "18:10" open-pull-requests-limit: 10 + groups: + nuget-minor-patch: + update-types: + - "minor" + - "patch" - package-ecosystem: "gradle" directory: "/" # Location of package manifests schedule: interval: "daily" + groups: + gradle-minor-patch: + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml new file mode 100644 index 0000000..91cda5c --- /dev/null +++ b/.github/workflows/dependabot-automerge.yml @@ -0,0 +1,32 @@ +name: Dependabot auto-merge + +on: + pull_request: + branches: + - master + +permissions: + contents: write + pull-requests: write + +jobs: + automerge: + if: github.event.pull_request.user.login == 'dependabot[bot]' + runs-on: ubuntu-latest + + steps: + - name: Fetch Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v2 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + # Major updates are left for manual review + - name: Approve and enable auto-merge for patch and minor updates + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: | + gh pr review --approve "$PR_URL" + gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From 5908f61348e4078311e03d5f4525125be6d4c18c Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 06:07:07 +0000 Subject: [PATCH 2/3] Pin dependabot/fetch-metadata to a full commit SHA Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01DJB71D4PQASW44W45J3vJg --- .github/workflows/dependabot-automerge.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 91cda5c..e717e84 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -17,7 +17,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v2 + uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0 with: github-token: ${{ secrets.GITHUB_TOKEN }} From e6f891487edf901b25d560c6c67f86a20e5c6293 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 16 Oct 2026 06:13:18 +0000 Subject: [PATCH 3/3] Harden Dependabot auto-merge - Wait 5 days after a release before Dependabot proposes it, so compromised releases are likely pulled before they are merged and published. - Only act when Dependabot itself triggered the run, not when someone else pushed to a Dependabot branch. - Grant write permissions at job level and none at workflow level. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01DJB71D4PQASW44W45J3vJg --- .github/dependabot.yml | 4 ++++ .github/workflows/dependabot-automerge.yml | 9 +++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c8da652..b02996c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,8 @@ updates: interval: daily time: "18:10" open-pull-requests-limit: 10 + cooldown: + default-days: 5 groups: nuget-minor-patch: update-types: @@ -15,6 +17,8 @@ updates: directory: "/" # Location of package manifests schedule: interval: "daily" + cooldown: + default-days: 5 groups: gradle-minor-patch: update-types: diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index e717e84..87fbc9a 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -5,14 +5,15 @@ on: branches: - master -permissions: - contents: write - pull-requests: write +permissions: {} jobs: automerge: - if: github.event.pull_request.user.login == 'dependabot[bot]' + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.actor == 'dependabot[bot]' runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write steps: - name: Fetch Dependabot metadata