This is an automated email from the ASF dual-hosted git repository. rusackas pushed a commit to branch chore/dependabot-auto-approve-patch in repository https://gitbox.apache.org/repos/asf/superset.git
commit 05f66c1031eb27440762a400808311979ac4d938 Author: Superset Dev <[email protected]> AuthorDate: Mon Jul 27 22:28:22 2026 -0700 feat(ci): auto-approve Dependabot patch-level bumps Posts an approving review (via dependabot/fetch-metadata's update-type output) on Dependabot PRs that only bump a patch version. Scoped to patch only, per the original ask; minor/major bumps get no automated review and go through normal human review as before. This does NOT enable auto-merge. Checked before building anything: - allow_auto_merge is false at the repo level (confirmed via API) - GitHub's native auto-merge feature is off repo-wide, and flipping that is a separate, consequential, repo-wide settings decision, not something this workflow does on its own. - Branch protection (.asf.yaml) requires require_code_owner_reviews plus 1 approving review. Checked .github/CODEOWNERS against every path Dependabot actually opens PRs against (superset-frontend/, docs/, superset-websocket/ x2, pip at /) - none match any CODEOWNERS pattern, so a bot-posted approval satisfies the plain 1-approval requirement for those, same as GitHub's own documented fetch-metadata + `gh pr review --approve` recipe for repos with required reviews. One exception: the npm ecosystem scoped to .github/actions matches the /.github/ CODEOWNERS entry, so those PRs still need a human owner's approval regardless - this workflow posts a review there too, but it won't satisfy the code-owner requirement alone. Trigger/guard convention copied directly from the existing sync-requirements-for-python-dep-upgrade-pr.yml (plain `pull_request`, not `pull_request_target`): confirmed empirically via that workflow's own run history that a plain `pull_request` trigger gets a working, write-capable GITHUB_TOKEN for genuine Dependabot-authored PRs on this repo (Dependabot pushes branches directly to apache/superset, not a fork), rather than assuming pull_request_target was required. Pinned to dependabot/fetch-metadata v3.1.0 (25dd0e34f4fe68f24cc83900b1fe3fe149efef98); needs the same ASF Infra allowlist ticket as the other recent action additions before it can run. Co-Authored-By: Claude Fable 5 <[email protected]> --- .github/workflows/dependabot-auto-approve.yml | 61 +++++++++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/.github/workflows/dependabot-auto-approve.yml b/.github/workflows/dependabot-auto-approve.yml new file mode 100644 index 00000000000..447dd5649ac --- /dev/null +++ b/.github/workflows/dependabot-auto-approve.yml @@ -0,0 +1,61 @@ +name: Auto-approve Dependabot patch bumps + +# Posts an approving review on Dependabot PRs that only bump a patch +# version, using the same trigger/guard convention already proven to work +# for Dependabot PRs in sync-requirements-for-python-dep-upgrade-pr.yml +# (plain `pull_request` gets a working, write-capable GITHUB_TOKEN here +# because Dependabot pushes branches directly to this repo, not a fork). +# +# This does NOT auto-merge anything - repo-wide auto-merge is disabled +# (Settings > General > Pull Requests > "Allow auto-merge" is off), and +# flipping that is a separate, repo-wide decision this workflow doesn't +# make on its own. Branch protection also still requires 1 approving +# review; this just means that review can already exist by the time a +# human looks at the PR, for the (large majority of) ecosystems whose +# files aren't matched by any CODEOWNERS pattern. One ecosystem - the npm +# bump under .github/actions - matches the /.github/ CODEOWNERS entry, so +# those PRs will still need a human owner's approval regardless of this +# workflow; it posts a review there too, but that alone won't satisfy the +# code-owner requirement. +on: + pull_request: + types: [opened, synchronize] + +# Cancel a superseded run if Dependabot pushes to the same PR again before +# the previous run finished (matches the pattern used elsewhere in +# superset-docs-verify.yml). +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true + +permissions: {} + +jobs: + approve-patch-bump: + name: Approve patch-level bump + # Mirrors the guard in sync-requirements-for-python-dep-upgrade-pr.yml: + # limited to (1) PRs authored by Dependabot and (2) the upstream repo, + # since forked PRs don't get a write-capable token here anyway. + if: > + github.repository == 'apache/superset' && + github.event.pull_request.user.login == 'dependabot[bot]' && + github.event.pull_request.head.repo.fork == false + runs-on: ubuntu-latest + permissions: + pull-requests: write # to post the approving review via `gh pr review` + steps: + - name: Fetch Dependabot metadata + id: metadata + # Do not bump this action version without opening an ASF Infra + # ticket to allow the new SHA first! + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + + - name: Approve patch-level bump + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_URL: ${{ github.event.pull_request.html_url }} + DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }} + run: | + gh pr review --approve "$PR_URL" \ + --body "Auto-approved: patch-level bump only ($DEPENDENCY_NAMES)."
