dependabot / dependabot/dependabot-core

Support auto merge in Dependabot

Open
#1,973 106 comments 114 reactions 0 assignees View on GitHub
auto-merge F: preview-migration Keep service 💁
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
155

Description

For my private repository it's not possible to add the auto merge feature. I added dependabot via the web interface and I receive PRs but the PRs are not merged automatically.

After this did not work I also tried via the dependabot config. The behaviour is the same. The check runs daily and creates PRs but does not merge them.

```yaml
version: 1
update_configs:
- package_manager: "javascript"
directory: "/"
update_schedule: "daily"
automerged_updates:
- match:
dependency_type: "development"
# Supported dependency types:
# - "development"
# - "production"
# - "all"
update_type: "all"
# Supported updates to automerge:
# - "security:patch"
# SemVer patch update that fixes a known security vulnerability
# - "semver:patch"
# SemVer patch update, e.g. > 1.x && 1.0.1 to 1.0.3
# - "semver:minor"
# SemVer minor update, e.g. > 1.x && 2.1.4 to 2.3.1
# - "in_range"
# matching the version requirement in your package manifest
# - "all"
- match:
dependency_type: "production"
update_type: "all"
```

Contributor guide

Open the contributing guide

Research direction

Start by reviewing Dependabot's web-interface setup and the YAML update_configs example, then trace how automerged_updates is handled for private repositories. Compare the reported daily PR behavior with the requested rules. Done means matching private-repository pull requests are merged automatically according to the configured dependency and update types.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.