fix: adopt canonical hardened automerge template - #2
Merged
Conversation
The workflow called gh pr merge --auto with nothing gating it, and this repo has DEPENDABOT_AUTOMERGE_TOKEN provisioned, so minor/patch bumps were auto-merging with nothing waiting on ci_validate_cmake.yml. Replaced with the canonical template from vln-devsecops/guidance, which gates the merge on the PR head commit's own check runs.
There was a problem hiding this comment.
Pull request overview
This PR replaces the repository’s Dependabot auto-merge workflow with a hardened canonical template that prevents unguarded merges when the default branch has no required status checks configured. It implements a “fail closed” gate by polling the PR head commit’s check runs and only enabling auto-merge when all other checks have completed successfully.
Changes:
- Adds an explicit “wait for other checks” gate based on the head SHA’s check runs (with self-run exclusion and time bounds).
- Makes auto-merge opt-in by requiring
DEPENDABOT_AUTOMERGE_TOKEN(noGITHUB_TOKENfallback) and emits a notice when not provisioned. - Updates permissions and trigger types to support reading checks and running on Dependabot PR activity.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo is auto-merging unguarded right now
.github/workflows/ci_dependabot_automerge.ymlcallsgh pr merge --auto --squashwith nothing gating it, andDEPENDABOT_AUTOMERGE_TOKENis provisioned here — so this is live, not latent. Minor/patch Dependabot PRs are merging without waiting forci_validate_cmake.yml.gh pr merge --autodoes not mean "merge when CI passes"; it means "merge when the repository's merge requirements are satisfied".masterhas no branch protection and no required status check, so there are no requirements and it merges immediately. That is exactly how node-dashboard#37 merged past a failingplanjob.Fix
Verbatim copy of the canonical template from
guidance@main. It polls the PR head commit's own check runs and blocks the merge unless every other check completed successfully — so it fails closed regardless of branch-protection config or plan tier.ci_validate_cmake.ymlgives it something real to wait on.Do not hand-edit it: the trigger, token handling, run-id self-exclusion and settle window are each load-bearing and each was a real failure elsewhere in the portfolio. See
runbooks/dependabot-automerge.md.Found during a cross-org scan on 2026-08-03 that extended to
vln-bookstore,rxmail-io,vln-sneakyimmediatetapewormandcpp4theselftaught— orgs not covered by earlier passes.