Summary
The Dependabot auto-merge workflow currently only handles npm dev-dependency updates. GitHub Actions bumps are left for a maintainer to review and merge by hand, even though they're routine and low-risk. We should extend the workflow to also auto-merge non-major GitHub Actions updates.
This came up with #5581 (the codeql-action group bump), which the workflow correctly left alone because GitHub Actions are out of its current scope.
Why is this needed?
GitHub Actions updates are some of the most frequent and most routine Dependabot PRs we get, and hand-merging them is exactly the kind of toil the auto-merge workflow was built to remove. They're also arguably safer to auto-merge than npm dependencies: our actions are pinned to commit SHAs, secure-workflows.yml re-pins them, and they never touch code we publish.
Which area does this relate to?
Automation, Governance
Solution
Make the workflow's scope check ecosystem-aware instead of npm-only:
- npm (
npm_and_yarn) — unchanged: only direct development dependencies are eligible.
- GitHub Actions (
github_actions) — newly eligible. GitHub Actions have no development/production distinction, so Dependabot always reports them as direct:production. That means the existing "must be a dev dependency" check can't apply here; instead we rely on the non-major guard below plus the existing commit-provenance check (every commit must be authored by Dependabot and signed by GitHub).
- Any other ecosystem — left for manual review, as today.
The non-major guard stays in place for both ecosystems, so major updates (e.g. actions/checkout v7 → v8) still go to a human — those can change runner behaviour or inputs and deserve a look. We can relax that later if it turns out to be unnecessary friction.
Nothing about the security model changes: the commit-provenance gate and GitHub's native branch protection still apply unchanged. This only widens which ecosystems are considered in scope.
Acknowledgment
Future readers
Please react with 👍 and your use case to help us understand customer demand.
Summary
The Dependabot auto-merge workflow currently only handles npm dev-dependency updates. GitHub Actions bumps are left for a maintainer to review and merge by hand, even though they're routine and low-risk. We should extend the workflow to also auto-merge non-major GitHub Actions updates.
This came up with #5581 (the
codeql-actiongroup bump), which the workflow correctly left alone because GitHub Actions are out of its current scope.Why is this needed?
GitHub Actions updates are some of the most frequent and most routine Dependabot PRs we get, and hand-merging them is exactly the kind of toil the auto-merge workflow was built to remove. They're also arguably safer to auto-merge than npm dependencies: our actions are pinned to commit SHAs,
secure-workflows.ymlre-pins them, and they never touch code we publish.Which area does this relate to?
Automation, Governance
Solution
Make the workflow's scope check ecosystem-aware instead of npm-only:
npm_and_yarn) — unchanged: only direct development dependencies are eligible.github_actions) — newly eligible. GitHub Actions have no development/production distinction, so Dependabot always reports them asdirect:production. That means the existing "must be a dev dependency" check can't apply here; instead we rely on the non-major guard below plus the existing commit-provenance check (every commit must be authored by Dependabot and signed by GitHub).The non-major guard stays in place for both ecosystems, so major updates (e.g.
actions/checkoutv7 → v8) still go to a human — those can change runner behaviour or inputs and deserve a look. We can relax that later if it turns out to be unnecessary friction.Nothing about the security model changes: the commit-provenance gate and GitHub's native branch protection still apply unchanged. This only widens which ecosystems are considered in scope.
Acknowledgment
Future readers
Please react with 👍 and your use case to help us understand customer demand.