rusackas opened a new pull request, #42508: URL: https://github.com/apache/superset/pull/42508
### SUMMARY Adds a workflow that auto-approves Dependabot PRs bumping a dependency by a **patch version only**, using [`dependabot/fetch-metadata`](https://github.com/dependabot/fetch-metadata)'s `update-type` output. Minor and major bumps get no automated review — normal human review as today. This was originally suggested as "gate auto-approve/auto-merge on patch-level bumps." I checked before building anything, and **auto-merge doesn't hold up as suggested** — see below. What's in this PR is the auto-approve half only, scoped down deliberately. ### Why not auto-merge too - `allow_auto_merge` is `false` at the repo level (confirmed via the API) — GitHub's native auto-merge is switched off repo-wide. Enabling it is a separate, repo-wide settings decision (affects every PR, not just Dependabot's) that this workflow doesn't make on its own. - Branch protection (`.asf.yaml`) requires `require_code_owner_reviews: true` plus 1 approving review. I checked `.github/CODEOWNERS` against every path Dependabot actually opens PRs against (`superset-frontend/`, `docs/`, `superset-websocket/` ×2, and `pip` at `/`) — none match any CODEOWNERS pattern, so a bot-posted approval satisfies the plain 1-approval requirement for those, the same way GitHub's own documented `fetch-metadata` + `gh pr review --approve` recipe works for repos with required reviews. **One exception**: the `npm` ecosystem scoped to `.github/actions` matches the `/.github/` CODEOWNERS entry — those PRs will still need a real human owner's approval no matter what this workflow does. It posts a review there too (harmless), but it won't satisfy the code-owner requirement alone. So: for most of the actual Dependabot PR volume, this should get the review requirement out of the way before a human ever opens the PR, but merging is still a manual click same as today — auto-merge would need someone to deliberately flip the repo setting, which felt like a decision for a maintainer to make explicitly rather than something to bundle into this PR. ### Trigger choice Uses a plain `pull_request` trigger (types: `opened`, `synchronize`), not `pull_request_target`. I'd assumed Dependabot-triggered `pull_request` events get a read-only token regardless of the `permissions:` block (a real, commonly-cited GitHub Actions restriction) and almost built this around `pull_request_target` to work around it — but this repo's own `sync-requirements-for-python-dep-upgrade-pr.yml` already does a `git push` (needs `contents: write`) under a plain `pull_request` trigger for genuine Dependabot PRs, and I checked its actual run history/logs to confirm that push step succeeds today. Copied that same proven trigger/guard convention here instead of assuming the more complex trigger was necessary. ### TESTING INSTRUCTIONS 1. Get `dependabot/fetch-metadata` allowlisted for `apache/superset` (ASF Infra ticket — same process as the other recent action additions). 2. Watch the next patch-level Dependabot PR (any of the `npm`/`pip` ecosystems except `.github/actions`) and confirm it picks up an approving review automatically. 3. Confirm a minor/major bump PR gets no automated review. 4. Confirm a patch bump under the `.github/actions` npm scope still shows as needing review (the bot's approval alone shouldn't satisfy the code-owner gate there). ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
