Automatically merging dependabot PRs

One of the recurring themes of software development is patching security issues. Most repository hosting services have fairly good issue reporting at this point, but many organizations still struggle to apply those fixes in a timely fashion. This past week we were discussing how to reduce the overhead of this process, and I was curious: can you just auto-merge Github Dependabot pull-requests?

It turns out, [the answer is yes], and it works pretty well. You get control over which types of updates (patches, minor updates, major updates, etc) you want to auto-merge, and it will also respect your automated checks. If you have great CI/CD that runs blocking linting, typing and tests, then this works particularly well. If you don’t, then, well, this will be an effective mechanism to get you to having good linting, typing, and tests afer traversing a small ocean of tears.

I got this running for about a dozen repositories at work over the past few days, but I’ll show an example of setting up the same mechanism for my blog.

First, add a .github/workflows/dependabot-auto-merge.yml file to your repository that looks like this:

# Automatically approve and merge Dependabot PRs for minor and patch updates
name: Dependabot auto-merge
on: pull_request

permissions:
  contents: write
  pull-requests: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'lethain/irrational_hugo'
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v2
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
      - name: Approve Dependabot PR
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Enable auto-merge for Dependabot PRs
        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Then go to your repository settings (something like https://github.com/lethain/irrational_hugo/settings), and enable auto-merging for your repository. This still respects all required branch rules, like required test passes or approvals, etc.

Then make sure you have appropriate status checks for whatever linting, typing and tests you have in your repository.

Then enable Dependabot (something like https://github.com/lethain/irrational_hugo/settings/security_analysis). Even the default settings are just find.

Then you’re done. The PRs from dependabot will automatically merge going forward. There are lots of nuances here–I already found one issues that automatically merged despite an issue because of a missing test–but ultimately I think that’s valuable pressure to improve the testing quality, rather than a reason to avoid, or backtrack, on the approach.