Docs

Dependabot PR merge

Dependabot PR merge is the proactive companion to Dependabot CI fix. That one repairs a dependency-update PR whose CI went red and then hands off to this one; this workflow handles every green dependency PR — both the naturally-green ones and the ones ci-fix just fixed — and is the single owner of the merge decision: it reads the diff, decides whether the bump is trivial, and enables GitHub auto-merge (squash) so the safe ones land without a human in the loop.

Permission profile: repo-write — needed for the github_enable_auto_merge and github_merge_pull_request tools. It never pushes code or rebases branches itself. It prefers to enable auto-merge, which lets GitHub merge the PR once its required checks pass and refuses on a red or still-running PR — that is the green gate. It merges directly only in the one case where GitHub has no checks to wait on, and only after confirming the PR's mergeable_state is clean so a repo with no required checks can't slip a red PR through. When a trivial PR is merely behind the base branch or has a lockfile conflict, it asks the bot that opened the PR to rebase or recreate its own branch (via github_add_issue_comment / github_add_labels) rather than pushing a merge itself.

Pipeline

Assess trivial? → auto-merge

What it does

  • Runs against a single PR at a time — its context is bounded, so it can't overflow. Inspects through the github_list_pull_request_files tool (changed files + line counts) — no repository checkout needed — deliberately skips lockfile diffs, and pulls github_get_pull_request_diff only for a small non-lockfile source change
  • Classifies the change conservatively: only lockfile / manifest bumps, GitHub Actions tag/SHA bumps, type-only or mechanical edits count as trivial; anything touching runtime logic, anything security-sensitive, and major-version bumps are functional
  • If trivial, enables GitHub auto-merge (squash) so the PR merges once its checks pass. If GitHub refuses auto-merge because the PR is already mergeable with no required checks ("clean status"), it direct-squash-merges instead — but only after confirming mergeable_state is clean, so it won't land a PR whose non-required checks are failing; if the repository disallows auto-merge outright, it comments for a maintainer. Functional PRs are left for a human with a comment
  • If a trivial PR is behind the base branch or dirty (a lockfile conflict), it doesn't give up: it asks the bot that opened the PR to update its own branch — @dependabot rebase / @dependabot recreate for Dependabot, or Renovate's rebase label — because the bot regenerates lockfiles correctly. It enables auto-merge at the same time, so GitHub lands the PR once the rebase re-runs the checks green. A non-Dependabot/Renovate PR that's behind is left for a human to rebase
  • When in doubt, it does not auto-merge
  • Every run must sign off with a machine-readable completion marker; a run that inspects files but reaches no verdict and takes no action is recorded as failed, not a silent green
Auto-merge needs "Allow auto-merge" enabled on the repository and at least one required status check. If it isn't available, the workflow comments that the update looks trivial and asks a maintainer to merge.

Triggers

  • GitHub webhook: a check_suite.completed event with a success conclusion on a dependency-update PR (surfaced internally as pr.checks_passed). The connector pre-filters to Dependabot / Renovate — by the head commit author or the dependabot/ / renovate/ branch prefix — so ordinary green PRs fire nothing. The router routes it deterministically to this workflow. Requires the GitHub App to subscribe to Check suite events (Checks: read).
  • Cron backstop: a daily job whose runner finds the green Dependabot / Renovate PRs across managed repos in code (no LLM) and fans out one bounded run per PR — the same single-PR shape as the webhook. Runs queue against the global concurrency cap. Unlike the review scan, it runs alongside webhooks — a safety net for PRs that went green before boot or during a missed delivery. Auto-merge is idempotent and per-PR runs dedup by (repo, PR), so the overlap is harmless. (This replaced an agent mode: scan sweep that assessed a whole repo in one session and overflowed its context on busy repos.)
  • Maintainer mention: an @last-light comment on a green Dependabot / Renovate PR (e.g. "can you look at this?"). The router hands the PR author + check state to the classifier, which routes a green dependency PR here — the on-demand version of the webhook. (A red one routes to dependabot-ci-fix instead; an explicit "review this" still gets a normal review.)