Skip to content

chore(ci): add Dependabot (npm+actions) with grouped auto-merge #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
calltelemetry-jason merged 1 commit into from
Jun 1, 2026
Merged

chore(ci): add Dependabot (npm+actions) with grouped auto-merge #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "chore"
include: "scope"
# Collapse the weekly minor/patch churn into a single rolling PR
# instead of one PR per package.
groups:
npm-minor-patch:
patterns: ["*"]
update-types: ["minor", "patch"]
# Supply-chain delay: don't propose an update until the new version
# has been published for at least 3 days. Mitigates auto-merging a
# freshly-published malicious release.
cooldown:
semver-minor-days: 3
semver-patch-days: 3
# Majors always require a human; never auto-bumped or auto-merged.
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]

- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
commit-message:
prefix: "chore"
include: "scope"
# Keep the SHA-pinned action refs current (with changelogs) now that
# sha_pinning_required is enforced. One rolling PR for minor/patch.
groups:
github-actions:
patterns: ["*"]
update-types: ["minor", "patch"]
cooldown:
semver-minor-days: 3
semver-patch-days: 3
# Major action bumps stay human-reviewed.
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
35 changes: 35 additions & 0 deletions .github/workflows/dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
name: Dependabot auto-merge

# Auto-enable GitHub auto-merge ("--auto") for Dependabot patch/minor PRs.
# The PR still only merges once branch protection's required checks
# (the "build" job) pass. Gated to the trusted dependabot[bot] actor
# AND author; on: pull_request (not pull_request_target); never runs or
Comment on lines +4 to +6
# trusts third-party PR code.
on: pull_request

concurrency:
group: dependabot-automerge-${{ github.event.pull_request.number }}
cancel-in-progress: false
Comment on lines +8 to +12

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial | ⚡ Quick win

Add an explicit top-level permissions: {} for least privilege.

Without a workflow-level permissions block, the default token scope applies to any future job that lacks its own block (flagged by zizmor's excessive-permissions). Setting it to empty at the top and elevating only inside the dependabot job keeps the surface minimal and documents intent (also addresses the undocumented-permissions hint at Line 21).

🔒 Proposed change 
 on: pull_request
 
+# Deny by default; the dependabot job elevates only what it needs.
+permissions: {}
+
 concurrency:
   group: dependabot-automerge-${{ github.event.pull_request.number }}
   cancel-in-progress: false

And document the job-level grant:

     permissions:
+      # contents: enable auto-merge on the branch; pull-requests: act on the PR.
       contents: write
       pull-requests: write
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
on: pull_request
concurrency:
group: dependabot-automerge-${{ github.event.pull_request.number }}
cancel-in-progress: false
on: pull_request
# Deny by default; the dependabot job elevates only what it needs.
permissions: {}
concurrency:
group: dependabot-automerge-${{ github.event.pull_request.number }}
cancel-in-progress: false
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-automerge.yml around lines 8 - 12, Add a
top-level workflow permissions block set to an empty object to enforce least
privilege (insert permissions: {} at the top-level of the workflow), then
explicitly grant only the required permissions inside the dependabot job by
adding a job-level permissions block (e.g., under the job named "dependabot" add
permissions: with the specific scopes needed such as contents: write and
pull-requests: write as appropriate) so the workflow defaults to no privileges
and the dependabot job elevates only what it actually needs.


jobs:
dependabot:
name: Auto-merge Dependabot patch/minor PRs
runs-on: ubuntu-latest
# Verify both the triggering actor and the PR author to avoid actor spoofing.
if: github.actor == 'dependabot[bot]' && github.event.pull_request.user.login == 'dependabot[bot]'
permissions:
contents: write
pull-requests: write
steps:
- name: Fetch Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"

- name: Enable auto-merge for patch and minor updates
if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
run: gh pr merge --auto --squash "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}