From a1a6e399346912f10e04e9b56680f68ac6777be3 Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Wed, 22 Jul 2026 15:33:29 -0400 Subject: [PATCH] ci(github): use app token for dependabot merges --- .github/workflows/dependabot-auto-merge.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index fb7a4f9..df8df7a 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -19,16 +19,24 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" + - name: Generate app token + id: app-token + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 + with: + app-id: ${{ secrets.DEPENDABOT_AUTOMERGE_APP_ID }} + private-key: ${{ secrets.DEPENDABOT_AUTOMERGE_PRIVATE_KEY }} + - name: Approve PR if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps['app-token'].outputs.token }} - name: Enable auto-merge for Dependabot PRs if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps['app-token'].outputs.token }}