From ae6642963da2f879d3bb7901ae24f528fb6948bc Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Wed, 22 Jul 2026 15:10:33 -0400 Subject: [PATCH 1/2] ci(github): use app token for dependabot merges --- .github/workflows/dependabot-auto-merge.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index c2860dd..1042533 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -19,16 +19,24 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" + - name: Generate app token + id: app-token + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 + with: + app-id: ${{ secrets.DEPENDABOT_AUTOMERGE_APP_ID }} + private-key: ${{ secrets.DEPENDABOT_AUTOMERGE_PRIVATE_KEY }} + - name: Approve PR if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} - name: Enable auto-merge for Dependabot PRs if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_TOKEN: ${{ steps.app-token.outputs.token }} From 312c0eb5416d515969028546c20f6ef80526688a Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Wed, 22 Jul 2026 15:18:09 -0400 Subject: [PATCH 2/2] ci(github): use bracket notation for app token --- .github/workflows/dependabot-auto-merge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 1042533..83435ea 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -32,11 +32,11 @@ jobs: run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ steps.app-token.outputs.token }} + GH_TOKEN: ${{ steps['app-token'].outputs.token }} - name: Enable auto-merge for Dependabot PRs if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ steps.app-token.outputs.token }} + GH_TOKEN: ${{ steps['app-token'].outputs.token }}