Carry the merge bot so Dependabot pull requests can merge - #4
Merged
Conversation
`.github/dependabot.yml` is a baseline file for every fleet repo, and `merge-bot-pull-request.yml` is what services what it opens. This repo carried the first without the second, so bot pull requests had no way to merge and one was already sitting open. Two jobs are vendored: auto-merge on opened or reopened, and disable auto-merge when a maintainer pushes to the bot's branch. The merge method follows the base, squash for `develop` and a merge commit for `main`, matching what each ruleset allows. The codegen and upstream-version jobs are dropped. This repo has neither, and a job keyed on a bot login that never opens a pull request here would be dead code that reads as coverage. Every tier auto-merges, semver-major included, because the required checks are the gate rather than the size of the bump. Comments are rewritten to one sentence per line. The upstream copy is block-prose, which is the shape the comment rule forbids, and carrying it verbatim would import a defect into a file this repo owns. Clears the corresponding residual delta in `reports/Blog/audit.md` and the open decision in `TODO.md`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR vendors a GitHub Actions “merge bot” workflow so in-repo Dependabot pull requests can be automatically merged (and auto-merge can be disabled if a maintainer pushes commits), and then removes the corresponding “decision/todo” items from the repo’s tracking docs.
Changes:
- Add
.github/workflows/merge-bot-pull-request.ymlwith two jobs: enable auto-merge for Dependabot PRs on open/reopen, and disable auto-merge on maintainer pushes (synchronizeby a non-bot actor). - Remove the previously-tracked “decide/carry merge-bot workflow” items from
TODO.mdandreports/Blog/audit.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
TODO.md | Removes now-resolved merge-bot decision items. |
reports/Blog/audit.md | Clears the audit delta noting the missing merge-bot workflow. |
.github/workflows/merge-bot-pull-request.yml | Adds the merge-bot workflow to auto-merge Dependabot PRs and disable auto-merge on maintainer pushes. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.github/dependabot.ymlis a baseline file for every fleet repo, andmerge-bot-pull-request.ymlis what services what it opens. This repo carried the first without the second, so bot pull requests had no way to merge and #1 was already sitting open.Two jobs vendored:
merge-dependabot, auto-merge onopened/reopened, method by base (develop-> squash,main-> merge commit) matching what each ruleset allows.disable-auto-merge-on-maintainer-push, so a maintainer's commits do not merge along with the bot's.Dropped: the codegen and upstream-version jobs. This repo has neither, and a job keyed on a bot login that never opens a pull request here would be dead code that reads as coverage.
Every tier auto-merges, semver-major included, because the required checks are the gate rather than the size of the bump.
Comments are rewritten to one sentence per line, since the upstream copy is block-prose, which is the shape the comment rule forbids.
Clears the corresponding residual delta in
reports/Blog/audit.mdand the open decision inTODO.md.Note on why this was missing.
spec/files.jsondoes not listmerge-bot-pull-request.ymlfor any project type, whileWORKFLOW.mdD8.1 grades it andGOVERNANCE.mdlinks to it as an in-repo path. Reported to ptr727/ProjectTemplate#456.