ci: add dependabot auto-merge workflow + expand ecosystem coverage#10
Merged
Conversation
Auto-approve and auto-merge patch/minor dependabot PRs (major stays manual). Also add dotnet-sdk, github-actions, and uv ecosystems (grouped under an infrastructure multi-ecosystem-group) alongside the existing nuget config, mirroring dynamodb-efcore-provider. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ncipollina
commented
Jul 21, 2026
Auto-merge only waits on branch-protection required checks (just build/build here), so a docsite-only uv bump or github-actions bump could merge while its own path-triggered check was still pending or red. Add an explicit gh pr checks --watch --fail-fast step so the workflow itself waits on every check before enabling auto-merge. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
ncipollina
commented
Jul 21, 2026
The gate protected against a docs-site or workflow-syntax bump merging while its own path-triggered check was still pending or red — but that's low-stakes and cheap to fix after the fact (docs site re-deploy, one-line revert), not an app-code risk. Real app code (nuget, dotnet-sdk) is already covered by the required build/build branch-protection check, which auto-merge already waits on. The poll-for-all-checks approach also had a self-deadlock bug (this workflow's own still-running check would never resolve). Keeping this repo's automation light per code-of-conduct.md outweighs closing a low-blast-radius gap with meaningfully more complexity. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
dependabot-auto-merge.yml: auto-approves + auto-merges (squash) dependabot PRs for patch/minor updates; major updates stay manualdependabot.ymlwithdotnet-sdk,github-actions, anduv(docsite/) ecosystems, grouped under aninfrastructuremulti-ecosystem-group to bundle into a single PRdynamodb-efcore-provider(unverified there too, so worth watching after merge)Depends on org-wide "Allow auto-merge" being enabled — see LayeredCraft/.github#2.
Test plan
allow_auto_merge: trueto this repo🤖 Generated with Claude Code