From 24ce648c8fcac4e228852f89d09e355d601874d4 Mon Sep 17 00:00:00 2001 From: Daniel Rodriguez Date: Tue, 28 Jul 2026 18:07:27 -0700 Subject: [PATCH] fix(ci): merge Dependabot PRs directly instead of via --auto The merge step failed for most Dependabot PRs: GraphQL: Auto merge is not allowed for this repository (enablePullRequestAutoMerge) GitHub's auto-merge feature is disabled on this repo (allow_auto_merge=false), so `gh pr merge --auto` only ever worked by accident: when a PR happened to be fully green and mergeable at that moment, gh merged it directly, and otherwise the call errored. That is exactly the observed mix of success and failure runs, and why #82-#95 piled up unmerged with autoMerge=no. Enabling the repo setting is the other possible fix, and it is the worse one. There is no branch protection here, so there are no REQUIRED status checks -- repo-wide auto-merge would merge any PR the moment it became mergeable, regardless of whether CI had run. That is a footgun well beyond Dependabot. We do not need it. The two wait-for-check gates above already block until "Run go test" and "Run golangci-lint" report success, and the step's `if` requires both. By the time we reach the merge, the checks have demonstrably passed, so a direct merge is equivalent in safety -- and it fails loudly on conflict rather than queueing silently forever. Combined with GH_PAT from ab21bd1, the full path now works: bump merged as a real user -> Test/Lint/Release Please fire on main -> `fix(deps)` cuts a patch release. Verified that ab21bd1 (merged manually as a user) triggered Lint, Test and Release Please, while 37f1d0f (auto-merged under the old token) triggered none. --- .github/workflows/auto-merge.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index d288f57..e97a80a 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -80,8 +80,18 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GH_PAT }} run: | - echo "Test + Lint passed. Auto-merging Dependabot PR..." - gh pr merge ${{ github.event.pull_request.number }} --auto --squash --delete-branch + echo "Test + Lint passed. Merging Dependabot PR..." + # A direct merge, NOT `--auto`. GitHub's auto-merge is disabled on this + # repo (allow_auto_merge=false), so `--auto` failed with "Auto merge is + # not allowed for this repository (enablePullRequestAutoMerge)" whenever + # the PR was not already mergeable — which is why dep PRs piled up. + # Enabling the repo setting would be the other fix, but it is worse: with + # no branch protection there are no REQUIRED checks, so repo-wide + # auto-merge would merge any PR the moment it is mergeable, checks or not. + # We do not need it — the two wait-for-check gates above already prove + # Test and Lint passed before we get here, so merging now is equivalent + # and fails loudly on conflict instead of queueing silently. + gh pr merge ${{ github.event.pull_request.number }} --squash --delete-branch - name: Comment on non-eligible PR if: steps.check.outputs.eligible == 'false'