From fd25ffb0f2872d93c276969d766eeb03d161f9f5 Mon Sep 17 00:00:00 2001
From: Philip Thong <philip.thong@emerson.com>
Date: Tue, 25 Aug 2026 11:05:37 -0500
Subject: [PATCH 1/3] Auto actions for dependabot

---
 .github/workflows/auto_dependabot.yml | 35 +++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 .github/workflows/auto_dependabot.yml

diff --git a/.github/workflows/auto_dependabot.yml b/.github/workflows/auto_dependabot.yml
new file mode 100644
index 0000000..c315d14
--- /dev/null
+++ b/.github/workflows/auto_dependabot.yml
@@ -0,0 +1,35 @@
+name: Auto Actions for Dependabot
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  auto_approve_merge:
+    # Job level permissions are required to approve and merge PRs
+    permissions:
+      pull-requests: write
+      contents: write
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Dependabot metadata
+        id: dependabot
+        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Auto approve
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr review ${{ github.event.pull_request.number }} --approve --body "Auto approved by Dependabot"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Automerge
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr merge ${{ github.event.pull_request.number }} --squash --auto
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+

From 33b6b7256ae2952946f6343220a179a7ae07ffc4 Mon Sep 17 00:00:00 2001
From: Philip Thong <philip.thong@emerson.com>
Date: Tue, 25 Aug 2026 12:45:53 -0500
Subject: [PATCH 2/3] Allow all dependabot changes as long as PR build and test
 passes

---
 .github/workflows/auto_dependabot.yml | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/auto_dependabot.yml b/.github/workflows/auto_dependabot.yml
index c315d14..84ac3c3 100644
--- a/.github/workflows/auto_dependabot.yml
+++ b/.github/workflows/auto_dependabot.yml
@@ -15,20 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
     steps:
-      - name: Dependabot metadata
-        id: dependabot
-        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Auto approve
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        run: gh pr review ${{ github.event.pull_request.number }} --approve --body "Auto approved by Dependabot"
+        run: gh pr review "$PR_URL" --approve --body "Auto approved by Dependabot"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Automerge
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        run: gh pr merge ${{ github.event.pull_request.number }} --squash --auto
+        run: gh pr merge "$PR_URL" --squash --auto
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 3627493c5744c31649bea05f3ba7a1418f46dd42 Mon Sep 17 00:00:00 2001
From: Philip Thong <philip.thong@emerson.com>
Date: Tue, 25 Aug 2026 12:55:16 -0500
Subject: [PATCH 3/3] Added actions read to report test results

---
 .github/workflows/report_test_results.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/report_test_results.yml b/.github/workflows/report_test_results.yml
index 73f1055..77f506b 100644
--- a/.github/workflows/report_test_results.yml
+++ b/.github/workflows/report_test_results.yml
@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      actions: read
       checks: write
       pull-requests: write
     steps:
@@ -34,4 +35,4 @@ jobs:
         uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # v2.22.0
         with:
           files: "test_results/**/*.xml"
-        if: always()
\ No newline at end of file
+        if: always()