Skip to content

Commit 73d59ee

Browse files
xerialclaude
xerial
and
claude
authored
Add auto-merge workflow for Dependabot and Scala Steward PRs (#979)
* Add: auto-merge workflow for Dependabot and Scala Steward PRs Mirrors the wvlet/uni auto-merge pattern, adapted for this repo: - Uses pull_request_target so GITHUB_TOKEN gets the declared write permissions on Dependabot-authored PRs (avoids needing a GitHub App). - Skips Dependabot major-version bumps via dependabot/fetch-metadata. - Skips Scala Steward PRs labeled semver-major. - Squash-merges via --auto, so GitHub waits for required checks and reviews before merging. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Drop Scala Steward auto-merge job The semver-major label guard was a no-op: this repo's Scala Steward PRs only carry library-update (and sometimes internal), so the guard would have auto-merged every Scala Steward PR including major bumps. Defer Scala Steward auto-merge until the repo has proper semver labeling configured. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Scala Steward auto-merge job Restore the Scala Steward auto-merge job dropped in the previous commit. Guards on both `semver-major` and `early-semver-major` labels for forward compatibility with future label setup. Until those labels are configured, the guard is effectively a no-op (matching wvlet/uni's behavior); a follow-up can tighten this by adding the labels to the repo and configuring Scala Steward to apply them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent ca3fa54 commit 73d59ee

2 files changed

Lines changed: 125 additions & 0 deletions

File tree

‎.github/workflows/auto-merge.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: auto-merge
2+
# pull_request_target runs in the base-branch context, which is required so
3+
# that GITHUB_TOKEN gets the write permissions declared below even for PRs
4+
# opened by Dependabot (which would otherwise receive a read-only token on
5+
# regular pull_request events). This workflow never checks out PR head code,
6+
# so the usual pull_request_target injection risk does not apply.
7+
on: pull_request_target
8+
9+
permissions:
10+
contents: write
11+
pull-requests: write
12+
13+
jobs:
14+
auto-merge-dependabot:
15+
name: Auto-Merge Dependabot PRs
16+
runs-on: ubuntu-latest
17+
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
18+
steps:
19+
- name: Dependabot metadata
20+
id: metadata
21+
uses: dependabot/fetch-metadata@v2
22+
- name: Enable auto-merge for non-major updates
23+
if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major' }}
24+
run: gh pr merge --squash --auto "${{ github.event.pull_request.html_url }}"
25+
env:
26+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
27+
28+
auto-merge-scala-steward:
29+
name: Auto-Merge Scala Steward PRs
30+
runs-on: ubuntu-latest
31+
if: ${{ github.event.pull_request.user.login == 'scala-steward' }}
32+
steps:
33+
# Skip auto-merge if the PR carries a semver-major label. Note: this repo
34+
# does not yet apply semver labels to Scala Steward PRs, so this guard is
35+
# a no-op until early-semver-* labels are added to the repo and Scala
36+
# Steward is configured to apply them.
37+
- name: Enable auto-merge for non-major updates
38+
if: ${{ !contains(github.event.pull_request.labels.*.name, 'semver-major') && !contains(github.event.pull_request.labels.*.name, 'early-semver-major') }}
39+
run: gh pr merge --squash --auto "${{ github.event.pull_request.html_url }}"
40+
env:
41+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎plans/2026-05-05-auto-merge.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Add auto-merge GitHub Actions workflow
2+
3+
## Goal
4+
5+
Add a workflow that automatically enables auto-merge on PRs from trusted bots
6+
(Dependabot and Scala Steward) for non-major version bumps, mirroring the
7+
pattern used in `wvlet/uni/.github/workflows/auto-merge.yml`.
8+
9+
## Context
10+
11+
- Recent PR history shows the repo regularly receives many bot PRs:
12+
- `dependabot[bot]` — for GitHub Actions version bumps
13+
- `scala-steward` — for Scala/sbt/Java library updates
14+
- These currently require manual merge from the maintainer.
15+
- Repo settings already allow auto-merge (`allow_auto_merge: true`) and squash
16+
is the default merge method.
17+
- CI passes branch-protection checks on PRs; once a PR is approved and CI is
18+
green, GitHub will merge it automatically.
19+
20+
## Differences from wvlet/uni
21+
22+
- **No GitHub App token.** wvlet/uni uses a GitHub App (`APP_ID` +
23+
`APP_PRIVATE_KEY`) to bypass the read-only `GITHUB_TOKEN` that GitHub
24+
hands to `pull_request` workflows triggered by Dependabot. msgpack/msgpack-java
25+
doesn't have that App configured, so this workflow uses
26+
`on: pull_request_target` instead — that event runs in the base-branch
27+
context where the workflow's declared `permissions:` block actually grants
28+
write access to `GITHUB_TOKEN`. We never check out PR head code, so the
29+
usual `pull_request_target` injection risk does not apply.
30+
- **Scala Steward actor is `scala-steward`**, not wvlet/uni's
31+
`scala-steward-wvlet[bot]` or `xerial-bot` (visible in `gh pr list`).
32+
- **Filter on `github.event.pull_request.user.login`**, not `github.actor`,
33+
because under `pull_request_target` the latter can resolve to the merger
34+
rather than the PR author.
35+
36+
## Plan
37+
38+
1. Add `.github/workflows/auto-merge.yml` with two jobs:
39+
- **auto-merge-dependabot**: triggers when
40+
`github.event.pull_request.user.login == 'dependabot[bot]'`, uses
41+
`dependabot/fetch-metadata@v2` to read the update type, and runs
42+
`gh pr merge --squash --auto` only when the update is **not**
43+
`version-update:semver-major`.
44+
- **auto-merge-scala-steward**: triggers when
45+
`github.event.pull_request.user.login == 'scala-steward'` and
46+
auto-merges unless the PR carries a `semver-major` or
47+
`early-semver-major` label.
48+
2. Set workflow-level `permissions` to the minimum required:
49+
`contents: write` and `pull-requests: write`.
50+
3. Use `GITHUB_TOKEN` directly via `env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}`.
51+
52+
### Scala Steward label caveat
53+
54+
This repo's current Scala Steward PRs only carry `library-update` (and
55+
sometimes `internal`) — no semver labels are configured upstream, so the
56+
`semver-major` / `early-semver-major` guard is effectively a no-op until:
57+
- The labels are added to the repo (Scala Steward only applies labels that
58+
already exist), and
59+
- Scala Steward is configured (e.g. via `.scala-steward.conf`) to attach
60+
them.
61+
62+
This matches the same caveat in the wvlet/uni reference implementation,
63+
which uses `semver-spec-major` against `github.event.issue.labels` (not even
64+
the right field on a PR event) — so its guard is also effectively a no-op
65+
in practice. We accept the same trade-off here: most Scala Steward PRs are
66+
patch/minor library updates, CI runs across JDK 8/11/17/21/24 and will fail
67+
the merge-readiness checks if anything regresses, and a major bump that
68+
slips through can be reverted. A follow-up could tighten this by setting up
69+
proper semver labels.
70+
71+
## Out of scope
72+
73+
- Setting up a GitHub App for elevated bot identity.
74+
- Auto-approving PRs (a human approval may still be required by branch
75+
protection — auto-merge will simply wait for it).
76+
- Changing branch protection rules.
77+
- Configuring Scala Steward to apply semver labels (see caveat above).
78+
79+
## Validation
80+
81+
- Lint the YAML by checking the file parses (visual review + actionlint if
82+
available).
83+
- After merge, watch the next dependabot/scala-steward PR to confirm
84+
auto-merge gets enabled.

0 commit comments

Comments
 (0)