Skip to content

fix: dependabot automerge with alternate identity #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chris11-taylor-nttd merged 1 commit into from
May 5, 2026
Merged

fix: dependabot automerge with alternate identity #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 22 additions & 6 deletions .github/workflows/reusable-pr-dependabot-automerge.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,19 @@ name: Dependabot Auto-Merge
on:
workflow_call:
inputs:
# No inputs needed for this workflow, but we need to define at least one to make it callable.
placeholder:
type: string
skeleton_update_app_id:
description: "The GitHub App ID of the app to use for authentication when
auto-merging. The app must be installed on the repository and have
permissions to read and write code, as well as create pull requests."
required: false
default: ""
description: "This input is not used, but is required to make this workflow callable."
type: string
default: ${{ vars.LAUNCH_SKELETON_UPDATE_APP_ID }}
secrets:
LAUNCH_SKELETON_UPDATE_KEY:
description: "The private key for the GitHub App used for authentication when
auto-merging. The app must be installed on the repository and have
permissions to read and write code, as well as create pull requests."
required: true

permissions:
contents: write
Expand All @@ -20,8 +27,17 @@ jobs:
runs-on: ubuntu-latest
if: ${{ github.actor == 'dependabot[bot]' }}
steps:
# By passing the token of a GitHub app and having that identity perform the auto-merge,
# Dependabot no longer owns the PR and subsequent actions runs that would otherwise be
# skipped for Dependabot-authored PRs (release on merge to main) will run as expected.
- id: get-app-token
uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3
with:
app-id: ${{ inputs.skeleton_update_app_id }}
private-key: ${{ secrets.LAUNCH_SKELETON_UPDATE_KEY }}

- name: Enable auto-merge
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
GITHUB_TOKEN: ${{ steps.get-app-token.outputs.token }}
PR_URL: ${{ github.event.pull_request.html_url }}
run: gh pr merge --auto --squash "$PR_URL"
16 changes: 14 additions & 2 deletions docs/reusable-pr-dependabot-automerge.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@ Automatically enables GitHub's auto-merge (squash strategy) on pull requests cre

This workflow only runs when the PR actor is `dependabot[bot]`. For all other actors, the job is skipped.

A GitHub App token is used to perform the merge rather than `GITHUB_TOKEN`. This ensures that the resulting push to the default branch is attributed to the GitHub App rather than `dependabot[bot]`, which allows downstream workflows (such as a release process) to be triggered as expected. When Dependabot performs the merge directly, GitHub suppresses re-triggering of actions to prevent infinite loops.

## Usage

Add the following workflow to your repository (suggested name: `.github/workflows/pr-dependabot-automerge.yml`):
Expand All @@ -26,6 +28,8 @@ jobs:
contents: write
pull-requests: write
uses: launchbynttdata/launch-workflows/.github/workflows/reusable-pr-dependabot-automerge.yml@ref
with:
skeleton_update_app_id: ${{ vars.LAUNCH_SKELETON_UPDATE_APP_ID }}
secrets: inherit
```

Expand All @@ -36,8 +40,16 @@ Be sure you replace `ref` with an appropriate ref to this repository.

## Inputs

This workflow has no configurable inputs.
| Input | Type | Required | Default | Description |
|-------|------|----------|---------|-------------|
| `skeleton_update_app_id` | `string` | No | `vars.LAUNCH_SKELETON_UPDATE_APP_ID` | The GitHub App ID to use for authentication when enabling auto-merge. The app must be installed on the repository with permissions to read and write code and create pull requests. |

## Secrets

| Secret | Required | Description |
|--------|----------|-------------|
| `LAUNCH_SKELETON_UPDATE_KEY` | Yes | The private key for the GitHub App used for authentication. |

## Required Permissions

The calling workflow must grant `contents: write` and `pull-requests: write` permissions so that the `GITHUB_TOKEN` can enable auto-merge on the pull request.
The calling workflow must grant `contents: write` and `pull-requests: write` permissions. The GitHub App identified by `skeleton_update_app_id` and `LAUNCH_SKELETON_UPDATE_KEY` must be installed on the repository with permissions to read and write code and to read and write pull requests.
Loading