chore(ci): add Dependabot (npm+actions) with grouped auto-merge - #1
Conversation
- dependabot.yml: weekly npm + github-actions updates, grouped minor/patch into one rolling PR, 3-day cooldown, majors ignored - dependabot-automerge.yml: auto-merge patch/minor Dependabot PRs once the required 'build' check passes; actor+author gated to dependabot[bot], job-level least-privilege perms, per-PR concurrency
📝 WalkthroughSummary by CodeRabbitRelease Notes
WalkthroughThis pull request establishes automated dependency management by introducing Dependabot configuration and a complementary auto-merge workflow. Dependabot is configured to check for npm and github-actions updates weekly, consolidating minor and patch updates into rolling groups while blocking major updates for manual review. A 3-day safety cooldown is applied before proposing updates. A GitHub Actions workflow auto-merges patch and minor updates via squash strategy, with concurrency controls to manage in-flight runs. ChangesAutomated dependency management setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Adds Dependabot configuration and a GitHub Actions workflow to automatically enable GitHub auto-merge for Dependabot PRs, aligning this repo’s dependency automation with the other MCP repositories.
Changes:
- Introduces weekly Dependabot updates for
npmandgithub-actions, grouping patch/minor updates into rolling PRs and ignoring majors. - Adds a workflow that enables GitHub auto-merge (squash) for Dependabot patch/minor PRs using
dependabot/fetch-metadata.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/dependabot-automerge.yml |
Enables auto-merge for Dependabot patch/minor PRs via GH CLI, gated to Dependabot actor/author. |
.github/dependabot.yml |
Configures weekly grouped Dependabot updates for npm and GitHub Actions with majors ignored. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # (the "build" job) pass. Gated to the trusted dependabot[bot] actor | ||
| # AND author; on: pull_request (not pull_request_target); never runs or | ||
| # trusts third-party PR code. | ||
| on: pull_request |
| # The PR still only merges once branch protection's required checks | ||
| # (the "build" job) pass. Gated to the trusted dependabot[bot] actor | ||
| # AND author; on: pull_request (not pull_request_target); never runs or |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-automerge.yml:
- Around line 8-12: Add a top-level workflow permissions block set to an empty
object to enforce least privilege (insert permissions: {} at the top-level of
the workflow), then explicitly grant only the required permissions inside the
dependabot job by adding a job-level permissions block (e.g., under the job
named "dependabot" add permissions: with the specific scopes needed such as
contents: write and pull-requests: write as appropriate) so the workflow
defaults to no privileges and the dependabot job elevates only what it actually
needs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 05721495-3313-49c4-abd1-8f0ed1ff5c5a
📒 Files selected for processing (2)
.github/dependabot.yml.github/workflows/dependabot-automerge.yml
| on: pull_request | ||
|
|
||
| concurrency: | ||
| group: dependabot-automerge-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: false |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial | ⚡ Quick win
Add an explicit top-level permissions: {} for least privilege.
Without a workflow-level permissions block, the default token scope applies to any future job that lacks its own block (flagged by zizmor's excessive-permissions). Setting it to empty at the top and elevating only inside the dependabot job keeps the surface minimal and documents intent (also addresses the undocumented-permissions hint at Line 21).
🔒 Proposed change
on: pull_request
+# Deny by default; the dependabot job elevates only what it needs.
+permissions: {}
+
concurrency:
group: dependabot-automerge-${{ github.event.pull_request.number }}
cancel-in-progress: falseAnd document the job-level grant:
permissions:
+ # contents: enable auto-merge on the branch; pull-requests: act on the PR.
contents: write
pull-requests: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: pull_request | |
| concurrency: | |
| group: dependabot-automerge-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| on: pull_request | |
| # Deny by default; the dependabot job elevates only what it needs. | |
| permissions: {} | |
| concurrency: | |
| group: dependabot-automerge-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-automerge.yml around lines 8 - 12, Add a
top-level workflow permissions block set to an empty object to enforce least
privilege (insert permissions: {} at the top-level of the workflow), then
explicitly grant only the required permissions inside the dependabot job by
adding a job-level permissions block (e.g., under the job named "dependabot" add
permissions: with the specific scopes needed such as contents: write and
pull-requests: write as appropriate) so the workflow defaults to no privileges
and the dependabot job elevates only what it actually needs.
|
Re CodeRabbit nitpick (top-level |
Brings
cisco-ris-mcpin line with the other MCP repos' dependency automation.Changes
.github/dependabot.yml(new): weekly npm + github-actions; grouped minor/patch into one rolling PR;cooldown(3-day release-age delay); majors ignored..github/workflows/dependabot-automerge.yml(new): officialfetch-metadatapattern, auto-merges patch/minor Dependabot PRs after the requiredbuildcheck; actor+author gated todependabot[bot], job-level perms, concurrency.Companion settings (via API)
allow_auto_merge: true, branch protection onmain(build), fork-PR approval →all_external_contributors,sha_pinning_required: true(workflows already pinned).