ci: upgrade auto-merge with major version protection #11
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
|
Caution Review failedThe pull request is closed. Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughAdds a unified GitHub Actions workflow Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. 📜 Recent review detailsConfiguration used: Organization UI Review profile: CHILL Plan: Pro Cache: Disabled due to data retention organization setting Knowledge base: Disabled due to data retention organization setting 📒 Files selected for processing (1)
✏️ Tip: You can disable this entire section by setting Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR upgrades the Dependabot auto-merge workflow to provide major version protection and extends auto-merge capabilities to additional bot types. The old workflow blindly auto-merged all Dependabot PRs, while the new workflow adds safety checks for major version updates and supports multiple bot ecosystems.
Changes:
- Added major version detection for Dependabot PRs - patch/minor auto-merge, major requires manual review
- Extended auto-merge support to Renovate bot, AI agents (Copilot/Jules/Claude branches), and CodeRabbit-approved PRs
- Enhanced workflow triggers to respond to PR reviews and check suite completions
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
.github/workflows/dependabot-auto-merge.yml |
Removed simple workflow that auto-merged all Dependabot PRs without version checking |
.github/workflows/auto-merge.yml |
New comprehensive workflow with major version protection for Dependabot and auto-merge support for multiple bot types |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
There was a problem hiding this comment.
The workflow is missing concurrency controls, which means multiple instances of this workflow could run simultaneously for the same PR (e.g., when a PR is opened and then synchronized). This could lead to race conditions where multiple approval or auto-merge attempts occur. Add a concurrency group to ensure only one instance runs per PR at a time, for example: concurrency: { group: "auto-merge-${{ github.event.pull_request.number }}", cancel-in-progress: false }.
| concurrency: | |
| group: auto-merge-${{ github.event.pull_request.number || github.event.check_suite.pull_requests[0].number }} | |
| cancel-in-progress: false |
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
|
|
||
| - name: Auto-approve patch and minor updates | ||
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: gh pr review --approve "$PR_URL" | ||
|
|
||
| - name: Enable auto-merge for patch and minor | ||
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: gh pr merge --auto --squash "$PR_URL" | ||
|
|
||
| - name: Comment on major updates | ||
| if: steps.metadata.outputs.update-type == 'version-update:semver-major' | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
The workflow attempts to approve PRs using the GITHUB_TOKEN, but GitHub Actions does not allow a workflow to approve its own PR using the default token when the workflow is triggered by pull_request_target. The approval steps in all jobs will fail with a permissions error. You need to use a Personal Access Token (PAT) or GitHub App token with appropriate permissions stored in secrets, or remove the auto-approval steps and rely on required approvals being configured in branch protection rules.
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Auto-approve patch and minor updates | |
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh pr review --approve "$PR_URL" | |
| - name: Enable auto-merge for patch and minor | |
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| - name: Comment on major updates | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-major' | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| github-token: ${{ secrets.AUTO_MERGE_TOKEN }} | |
| - name: Auto-approve patch and minor updates | |
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.AUTO_MERGE_TOKEN }} | |
| run: gh pr review --approve "$PR_URL" | |
| - name: Enable auto-merge for patch and minor | |
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.AUTO_MERGE_TOKEN }} | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| - name: Comment on major updates | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-major' | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.AUTO_MERGE_TOKEN }} |
| coderabbit-auto-merge: | ||
| name: CodeRabbit auto-merge | ||
| runs-on: ubuntu-latest | ||
| if: | | ||
| github.event_name == 'pull_request_review' && | ||
| github.event.review.state == 'approved' && | ||
| github.event.review.user.login == 'coderabbitai[bot]' | ||
|
|
||
| steps: | ||
| - name: Enable auto-merge for CodeRabbit approved PRs | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: gh pr merge --auto --squash "$PR_URL" |
There was a problem hiding this comment.
The CodeRabbit auto-merge job only checks if CodeRabbit approved the PR, but doesn't verify that this approval is the only one or that it meets any quality standards. A malicious actor could potentially get CodeRabbit to approve a PR (e.g., by crafting seemingly innocuous changes) and have it auto-merged. Consider adding additional checks such as verifying CI status, checking that the PR is not in draft state, or requiring multiple approvals for certain types of changes.
|
|
||
| **Manual review required.** | ||
|
|
||
| Dependency: \`$DEP_NAMES\` |
There was a problem hiding this comment.
The dependency names output may contain multiple dependencies (comma-separated), but the comment message uses singular grammar "Dependency:" which could be misleading when multiple dependencies are updated. Consider using conditional logic to pluralize appropriately, or change to "Dependencies:" to cover both cases.
| name: Auto-merge | ||
|
|
||
| on: | ||
| pull_request_target: |
There was a problem hiding this comment.
The workflow uses pull_request_target which runs with elevated permissions even for PRs from forks. This creates a security risk because the workflow auto-approves and auto-merges PRs from AI agents based solely on branch name patterns, which could be spoofed by malicious actors. A fork could create a branch named copilot/malicious-code to trigger auto-merge. Consider using pull_request instead or adding additional authentication checks to verify the PR author is from a trusted source (e.g., internal team member or verified bot account).
| pull_request_target: | |
| pull_request: |
| - name: Enable auto-merge for Renovate | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: gh pr merge --auto --squash "$PR_URL" |
There was a problem hiding this comment.
The Renovate auto-merge job auto-merges ALL updates without checking for major version updates, unlike the Dependabot job which protects against major version changes. This inconsistency means major breaking changes from Renovate will be automatically merged without manual review. Consider adding similar version checking logic for Renovate PRs, or configure Renovate to include update type information in the PR that can be parsed.
| - name: Enable auto-merge for Renovate | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| - name: Skip auto-merge for Renovate (manual merge required) | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| run: | | |
| echo "Renovate PR $PR_URL has been auto-approved." | |
| echo "Auto-merge is intentionally disabled to avoid merging potential major version updates without manual review." |
| ai-agent-auto-merge: | ||
| name: AI Agent auto-merge | ||
| runs-on: ubuntu-latest | ||
| if: | | ||
| startsWith(github.event.pull_request.head.ref, 'copilot/') || | ||
| startsWith(github.event.pull_request.head.ref, 'jules/') || | ||
| startsWith(github.event.pull_request.head.ref, 'claude/') | ||
|
|
||
| steps: | ||
| - name: Identify AI agent | ||
| id: agent | ||
| env: | ||
| BRANCH: ${{ github.event.pull_request.head.ref }} | ||
| run: | | ||
| if [[ "$BRANCH" == copilot/* ]]; then | ||
| echo "agent=Copilot" >> "$GITHUB_OUTPUT" | ||
| elif [[ "$BRANCH" == jules/* ]]; then | ||
| echo "agent=Jules" >> "$GITHUB_OUTPUT" | ||
| elif [[ "$BRANCH" == claude/* ]]; then | ||
| echo "agent=Claude" >> "$GITHUB_OUTPUT" | ||
| fi | ||
|
|
||
| - name: Auto-approve AI agent PRs | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| AGENT: ${{ steps.agent.outputs.agent }} | ||
| run: | | ||
| echo "Auto-approving $AGENT PR" | ||
| gh pr review --approve "$PR_URL" --body "✅ Auto-approved: $AGENT autonomous fix PR" | ||
|
|
||
| - name: Enable auto-merge for AI agent PRs | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: gh pr merge --auto --squash "$PR_URL" |
There was a problem hiding this comment.
The AI agent auto-merge job has no safeguards or validation beyond the branch name prefix. It auto-approves and auto-merges any PR from branches starting with copilot/, jules/, or claude/ without verifying that CI checks have passed, that the PR is not in draft state, or that the code changes are safe. At minimum, add a check to ensure CI checks have passed before enabling auto-merge. Consider also checking that the PR is not in draft state using github.event.pull_request.draft == false.
… validation - Remove unused check_suite trigger (no job references it) - Add actor validation to AI agent job for security (prevents anyone from creating copilot/jules/claude branches)
Summary
Replaces basic
dependabot-auto-merge.ymlwith advancedauto-merge.yml:Before: Auto-merged ALL Dependabot PRs including major versions (breaking changes!)
After:
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.