From 73b76cb80a72c472a5ffb97e90db25a630e4c28b Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Wed, 22 Jul 2026 15:10:17 -0400 Subject: [PATCH 1/2] ci(github): use app token for dependabot merges --- .github/workflows/dependabot-auto-merge.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 71295e3..c80d1f1 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -19,16 +19,24 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" + - name: Generate app token + id: app-token + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 + with: + app-id: ${{ secrets.DEPENDABOT_AUTOMERGE_APP_ID }} + private-key: ${{ secrets.DEPENDABOT_AUTOMERGE_PRIVATE_KEY }} + - name: Approve PR if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} - name: Enable auto-merge for Dependabot PRs if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} From 6e3582a9e2e931f9eb3e1fad0c8e6e0968c94000 Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Wed, 22 Jul 2026 15:17:56 -0400 Subject: [PATCH 2/2] ci(github): use bracket notation for app token --- .github/workflows/dependabot-auto-merge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index c80d1f1..397a94f 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -32,11 +32,11 @@ jobs: run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ steps.app-token.outputs.token }} + GH_TOKEN: ${{ steps['app-token'].outputs.token }} - name: Enable auto-merge for Dependabot PRs if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ steps.app-token.outputs.token }} + GH_TOKEN: ${{ steps['app-token'].outputs.token }}