feat: add Dependabot auto-merge workflow - #327
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Unit Test Coverage
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c795b5cba0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| name: Dependabot auto-merge | ||
|
|
||
| on: | ||
| pull_request: |
There was a problem hiding this comment.
For Dependabot-authored PRs, this pull_request trigger runs in a fork-equivalent security context, so GitHub downgrades GITHUB_TOKEN to read-only despite the requested write permissions (GitHub documentation). Consequently, gh pr merge --auto --merge cannot update the PR and this workflow fails instead of enabling auto-merge; use a trusted pull_request_target or post-CI workflow_run context without executing code from the Dependabot branch.
Useful? React with 👍 / 👎.
1 participant
Flows down the Dependabot auto-merge improvement from
second-brain-architecture.Adds a workflow that runs only for Dependabot pull requests, fetches Dependabot metadata, and enables GitHub auto-merge using the repository
GITHUB_TOKEN.