Automate Dependabot minor/patch PR approvals & merges #476

Copilot · 2026-01-21T18:38:54Z

Dependabot Automation Implementation Plan

Summary

Successfully implemented Dependabot automation for minor and patch version updates with all feedback addressed.

Changes Made:

Updated .github/dependabot.yml:
- Added auto-merge-minor-and-patch group for Maven with 36 dependencies (24 runtime + 11 build plugins + 1 parent POM)
- Added auto-merge-minor-and-patch group for GitHub Actions with 7 actions
- All dependencies extracted from pom.xml files and listed alphabetically
- Maven dependencies include: runtime libs, build plugins, and parent POM (spring-boot-starter-parent)
- Groups configured to handle only minor and patch updates
- Changed interval to "daily" for Maven ecosystem
Created .github/workflows/dependabot-auto-approve.yml:
- Automatically approves Dependabot PRs for minor/patch updates
- Uses dependabot/fetch-metadata@v2 to determine update type
- Only processes Dependabot bot PRs
- Limited to opened and reopened events to avoid duplicate approvals
- Uses github.token consistently for all authentication
Created .github/workflows/dependabot-auto-merge.yml:
- Triggers on pull_request_review with submitted activity type
- Checks review state is 'approved'
- Enables auto-merge for approved minor/patch Dependabot PRs
- Uses squash merge for clean history
- Only processes Dependabot bot PRs when review is approved
- Uses github.token consistently for all authentication

Result:

✅ Minor and patch updates automatically approved and merged
✅ Major version updates require manual review (no automation)
✅ All YAML files validated successfully
✅ Auto-merge workflow properly sequenced after approval
✅ Proper event filtering with activity types
✅ All PR review feedback addressed
✅ Maven plugin dependencies and parent POM included
✅ Consistent token usage across all workflow steps
✅ Idiomatic GitHub Actions syntax

Original prompt

This section details on the original issue you should resolve

<issue_title>[Chore]: Automate Dependabot minor/patch PR approvals & merges; require review for major versions</issue_title>
<issue_description>### What

Implement automation so that Dependabot pull requests for minor and patch version updates are automatically approved and merged. Major version updates should require manual review and merge.

Why

Automatically handling minor and patch dependency updates streamlines maintenance and keeps dependencies secure and up-to-date with minimal effort. Manual review for major version updates allows the team to assess breaking changes and ensure stability.

Notes

This will involve, changes to Dependabot settings, and additional workflow files to distinguish the PR types and set automerge behaviors accordingly.

Create dependabot-auto-approve.yml and dependabot-auto-merge.yml.

In the dependabot.yml all of the dependencies in the project should go into a group with the name auto-merge-minor-and-patch. Extract all of the dependencies from the pom files, duplicate them and put them in to the auto-merge-minor-and-patch group in alphabetical order. Ignore the dependencies that are internal to the project. </issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes [Chore]: Automate Dependabot minor/patch PR approvals & merges; require review for major versions #475

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

- Updated dependabot.yml with auto-merge-minor-and-patch groups for both maven and github-actions ecosystems - Created dependabot-auto-approve.yml workflow to automatically approve minor and patch updates - Created dependabot-auto-merge.yml workflow to automatically merge approved minor and patch PRs - Extracted all external dependencies from pom files and added them to the configuration in alphabetical order Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

.github/dependabot.yml

Copilot

Pull request overview

Automates handling of Dependabot minor/patch updates by grouping them and adding GitHub Actions workflows to auto-approve and enable auto-merge, while leaving major updates for manual review.

Changes:

Added Dependabot grouping for minor/patch updates in Maven and GitHub Actions ecosystems.
Introduced a workflow to auto-approve Dependabot minor/patch PRs using fetched metadata.
Introduced a workflow to enable auto-merge (squash) for Dependabot minor/patch PRs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
.github/dependabot.yml	Adds grouped minor/patch update configuration for Maven and GitHub Actions dependencies.
.github/workflows/dependabot-auto-approve.yml	Auto-approves Dependabot PRs based on semver update type metadata.
.github/workflows/dependabot-auto-merge.yml	Enables GitHub auto-merge for Dependabot PRs when update type is minor/patch.

.github/workflows/dependabot-auto-approve.yml

.github/workflows/dependabot-auto-merge.yml

.github/dependabot.yml

.github/workflows/dependabot-auto-merge.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

thomasturrell · 2026-01-21T19:11:32Z

@copilot apply changes based on the comments in this thread

- Add dependabot/fetch-metadata to GitHub Actions auto-merge group - Change auto-merge workflow trigger to pull_request_review to run after approval - Ensure auto-merge only runs when review is approved Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

Copilot · 2026-01-21T19:14:20Z

@copilot apply changes based on the comments in this thread

Applied all changes from the review thread in commit 0e73cd7:

Added dependabot/fetch-metadata to GitHub Actions patterns
Changed auto-merge workflow to trigger on pull_request_review after approval

- Ensure workflow only runs when review is submitted (not dismissed or other events) - Add github.event.action == 'submitted' check for better event filtering Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

thomasturrell · 2026-01-21T19:27:45Z

@copilot should the java plugin dependencies be added too? I am not sure so evaluate the pros and cons of this suggestion and then add them if the pros outweigh the cons.

- Added 11 Maven plugin dependencies to auto-merge-minor-and-patch group - Includes maven-checkstyle-plugin, maven-compiler-plugin, maven-failsafe-plugin, maven-gpg-plugin, maven-javadoc-plugin, maven-release-plugin, maven-source-plugin, maven-surefire-plugin, lifecycle-mapping, jacoco-maven-plugin, and central-publishing-maven-plugin - Total Maven dependencies now: 35 (24 runtime + 11 plugins) - Plugins follow semantic versioning and minor/patch updates are safe to auto-merge with CI validation Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

Copilot · 2026-01-21T19:30:40Z

@copilot should the java plugin dependencies be added too? I am not sure so evaluate the pros and cons of this suggestion and then add them if the pros outweigh the cons.

Evaluation: Pros outweigh cons - Added Maven plugins in commit 66afc7e

PROS:

Security updates and bug fixes for build tooling
Maven plugins follow semantic versioning (minor/patch are backwards compatible)
CI must pass before auto-merge (safety net)
Consistency in managing all project dependencies

CONS:

Build plugins could theoretically change behavior
Some plugins are critical (maven-release-plugin, maven-gpg-plugin)

Decision: Added 11 Maven plugins since:

Only minor/patch auto-merge (major still needs review)
CI validation catches issues before merge
Security/bug fixes for build tooling are valuable

Added: maven-checkstyle-plugin, maven-compiler-plugin, maven-failsafe-plugin, maven-gpg-plugin, maven-javadoc-plugin, maven-release-plugin, maven-source-plugin, maven-surefire-plugin, lifecycle-mapping, jacoco-maven-plugin, central-publishing-maven-plugin

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

.github/workflows/dependabot-auto-approve.yml

.github/workflows/dependabot-auto-merge.yml

.github/dependabot.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

- Change GITHUB_TOKEN to GH_TOKEN in both workflows to match repo pattern - Add org.springframework.boot:spring-boot-starter-parent to auto-merge group - Total Maven dependencies now: 36 (24 runtime + 11 plugins + 1 parent) Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

- Use github.token for dependabot/fetch-metadata action in both workflows - Ensures consistent token usage across all workflow steps - Matches repo pattern of using github.token instead of secrets.GITHUB_TOKEN Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

.github/workflows/dependabot-auto-merge.yml

- Move 'submitted' from if condition to trigger types - Cleaner and more idiomatic GitHub Actions syntax - Simplifies the if condition by removing redundant action check Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

sonarqubecloud · 2026-01-21T23:24:58Z

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

Initial plan

5501957

Copilot AI assigned Copilot and thomasturrell Jan 21, 2026

Copilot started work on behalf of thomasturrell January 21, 2026 18:39 View session

Copilot AI changed the title ~~[WIP] Automate Dependabot minor and patch PR approvals and merges~~ Automate Dependabot minor/patch PR approvals & merges Jan 21, 2026

Copilot AI requested a review from thomasturrell January 21, 2026 18:46

Copilot finished work on behalf of thomasturrell January 21, 2026 18:46

thomasturrell approved these changes Jan 21, 2026

View reviewed changes

thomasturrell marked this pull request as ready for review January 21, 2026 18:55

Copilot AI review requested due to automatic review settings January 21, 2026 18:55

Copilot started reviewing on behalf of thomasturrell January 21, 2026 18:55 View session

thomasturrell reviewed Jan 21, 2026

View reviewed changes

.github/dependabot.yml Outdated Show resolved Hide resolved

Apply suggestion from @thomasturrell

54c3e3f

Copilot AI reviewed Jan 21, 2026

View reviewed changes

.github/workflows/dependabot-auto-approve.yml Outdated Show resolved Hide resolved

.github/workflows/dependabot-auto-merge.yml Outdated Show resolved Hide resolved

.github/dependabot.yml Show resolved Hide resolved

.github/workflows/dependabot-auto-merge.yml Show resolved Hide resolved

thomasturrell and others added 2 commits January 21, 2026 19:10

Update .github/workflows/dependabot-auto-approve.yml

0b10224

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update .github/workflows/dependabot-auto-merge.yml

4a04562

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of thomasturrell January 21, 2026 19:12 View session

Add action check to auto-merge workflow

5ac1903

- Ensure workflow only runs when review is submitted (not dismissed or other events) - Add github.event.action == 'submitted' check for better event filtering Co-authored-by: thomasturrell <1552612+thomasturrell@users.noreply.github.com>

Copilot AI requested a review from thomasturrell January 21, 2026 19:16

Copilot finished work on behalf of thomasturrell January 21, 2026 19:16

thomasturrell requested a review from Copilot January 21, 2026 19:26

Copilot started reviewing on behalf of thomasturrell January 21, 2026 19:27 View session

Copilot started work on behalf of thomasturrell January 21, 2026 19:28 View session

Copilot finished work on behalf of thomasturrell January 21, 2026 19:32

Copilot AI reviewed Jan 21, 2026

View reviewed changes

.github/workflows/dependabot-auto-approve.yml Outdated Show resolved Hide resolved

.github/workflows/dependabot-auto-approve.yml Outdated Show resolved Hide resolved

.github/workflows/dependabot-auto-merge.yml Outdated Show resolved Hide resolved

.github/dependabot.yml Show resolved Hide resolved

Update .github/workflows/dependabot-auto-approve.yml

baee690

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot started work on behalf of thomasturrell January 21, 2026 19:44 View session

Copilot AI and others added 2 commits January 21, 2026 19:46

Copilot finished work on behalf of thomasturrell January 21, 2026 19:48

thomasturrell reviewed Jan 21, 2026

View reviewed changes

.github/workflows/dependabot-auto-merge.yml Outdated Show resolved Hide resolved

Copilot started work on behalf of thomasturrell January 21, 2026 19:53 View session

thomasturrell requested a review from Copilot January 21, 2026 19:55

Copilot finished work on behalf of thomasturrell January 21, 2026 19:55

Copilot AI requested a review from thomasturrell January 21, 2026 19:55

Copilot started reviewing on behalf of thomasturrell January 21, 2026 19:56 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

thomasturrell approved these changes Jan 21, 2026

View reviewed changes

thomasturrell merged commit 8796527 into main Jan 21, 2026
10 of 11 checks passed

thomasturrell deleted the copilot/automate-dependabot-pr-approvals branch January 21, 2026 23:26

Automate Dependabot minor/patch PR approvals & merges #476

Automate Dependabot minor/patch PR approvals & merges #476

Uh oh!

Conversation

Copilot AI commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependabot Automation Implementation Plan

Summary

Changes Made:

Result:

Why

Notes

Comments on the Issue (you are @copilot in this section)

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thomasturrell commented Jan 21, 2026

Uh oh!

Copilot AI commented Jan 21, 2026

Uh oh!

thomasturrell commented Jan 21, 2026

Uh oh!

Copilot AI commented Jan 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

sonarqubecloud bot commented Jan 21, 2026

Quality Gate failed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 21, 2026 •

edited

Loading