Bump the minor-and-patch group across 1 directory with 13 updates #6

	name: Dependabot auto-merge

	on: pull_request

	permissions:
	contents: write
	pull-requests: write

	jobs:
	auto-merge:
	runs-on: ubuntu-latest
	if: github.event.pull_request.user.login == 'dependabot[bot]'
	steps:
	- name: Fetch Dependabot metadata
	id: metadata
	uses: dependabot/fetch-metadata@v2
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}

	# Auto-merge everything except Python-ecosystem majors:
	# - grouped PRs report the highest bump anywhere in the group (including
	# transitive lockfile updates), so trust our own minor-and-patch groups
	# - GitHub-Actions majors are CI-validated and low blast radius
	- name: Enable auto-merge for eligible updates
	if: >-
	steps.metadata.outputs.package-ecosystem == 'github_actions' \|\|
	contains(steps.metadata.outputs.dependency-group, 'minor-and-patch') \|\|
	steps.metadata.outputs.update-type != 'version-update:semver-major'
	env:
	PR_URL: ${{ github.event.pull_request.html_url }}
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	gh pr review --approve "$PR_URL"
	gh pr merge --auto --squash "$PR_URL"

	- name: Flag major updates for manual review
	if: >-
	steps.metadata.outputs.package-ecosystem != 'github_actions' &&
	!contains(steps.metadata.outputs.dependency-group, 'minor-and-patch') &&
	steps.metadata.outputs.update-type == 'version-update:semver-major'
	env:
	PR_URL: ${{ github.event.pull_request.html_url }}
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	gh pr comment "$PR_URL" --body \
	"Major version bump — left open for manual review (auto-merge covers patch/minor only)."

Navigation Menu