[defangdevs]

Auto-merge every Dependabot update, including major and security updates, only after CI is green for the exact commit being merged. The repositories do not currently enforce CI checks as merge requirements, so simply enabling GitHub auto-merge would allow merges before CI finishes.

The workflow checks the latest Actions runs, check runs, and legacy commit statuses. Pending, failed, cancelled, or absent checks leave the PR open. Neutral/skipped checks may accompany successful CI, but at least one successful check is required. It approves and squash-merges only open, non-draft Dependabot PRs from this repository, revalidates the current head, and uses the merge API's SHA guard. Existing review/merge protections remain authoritative.

CI completion triggers the check; external check/status events and an hourly retry cover checks that finish last. The workflow never checks out or executes PR code, ignores its own obsolete automation checks, and continues the retry sweep after individual PR failures. Manual dispatch defaults to a read-only preview. The reviewer-request workflow is removed.

Activation requirement: configure a maintenance GitHub App/PAT credential as the DEPENDABOT_AUTOMERGE_TOKEN Actions secret (or update the reference to the existing organization credential). It needs Actions/checks/statuses read and contents/pull-requests write for these repositories. The built-in token is read-only and may only serve preview/read operations; it cannot perform merges. A separate credential is necessary so the merge still triggers normal push-based deployment and post-merge CI. This PR remains a draft while that credential is unresolved. Never add this CI-only credential to application environments or Compose.

Validation: 55 behavior tests execute the exact inline script shipped in the workflow; workflow lint and Station's Biome check pass. Cases cover failed/pending/no checks, major updates, stale heads, forks, pagination, reruns, merge protections, credential absence, dry runs, external-check retries, and a blocked PR followed by a mergeable PR in the same sweep. Real API read-only checks are recorded separately; no dependency PR was approved or merged during validation.

The standing DefangLabs webhook watch already observes ordinary Actions CI failures on any branch; this PR leaves that routing intact.

Constitution: security and simplicity pass (no untrusted checkout, minimal token scopes, exact-SHA merge, native protections preserved); product DX, multi-cloud and cloud resource gates are not applicable.

• This PR adds or changes no user-facing copy

References: GITHUB_TOKEN event suppression, workflow completion and trigger rules.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Essentials
• Run ID: 518f21d9-0727-4d6d-aa02-b14d7e987b1b

Commits

Reviewing files that changed from the base of the PR and between 3fb1bfa and 2bb870c.

Files selected for processing: 1

• .github/workflows/dependabot-review.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

Walkthrough

The new workflow runs for opened, reopened, and ready-for-review pull requests. It requests a review from defangdevs when the pull request is from dependabot[bot] and is not a draft.

Changes: Dependabot review assignment

Layer / File(s)	Summary
Workflow triggers and reviewer request .github/workflows/dependabot-review.yml	The workflow handles opened, reopened, and ready-for-review pull requests. For non-draft pull requests from dependabot[bot], it uses gh api to request a review from defangdevs. The job has pull-requests: write permission and does not check out the repository.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: lionello

Merge Risk: Moderate · previous review 2bb87

The workflow can silently fail to request reviews for Dependabot updates; configure a trusted write-capable integration before merging.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Title check		The title describes merging Dependabot updates after CI passes, but the change adds a workflow that requests reviews from defangdevs for eligible Dependabot pull requests.	Rename the pull request to clearly describe the reviewer-request workflow, for example: "chore(ci): request Dependabot reviews from defangdevs".

Passed checks: 3 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}