Repository navigation
chore: remove auto-merge-dependabot reusable workflow - #28
Conversation
Auto-approving and merging Dependabot PRs is a supply-chain attack vector — a compromised upstream package with a semver patch bump gets merged without human review. Dependabot PRs should be reviewed manually. Closes #18
There was a problem hiding this comment.
Pull request overview
Removes the reusable GitHub Actions workflow that auto-approves and auto-merges Dependabot PRs, reducing supply-chain risk by ensuring dependency updates require human review (or non-merging CI review).
Changes:
- Deleted
.github/workflows/auto-merge-dependabot.ymlreusable workflow. - Removed “Auto-merge Dependabot” documentation from
README.md. - Removed the workflow entry from the directory tree in
AGENTS.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| README.md | Removes documentation section showing how to call the auto-merge Dependabot workflow. |
| AGENTS.md | Updates the “What’s Here” tree to no longer list the removed reusable workflow. |
| .github/workflows/auto-merge-dependabot.yml | Deletes the reusable workflow that approved/enabled auto-merge for Dependabot PRs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| .github/ | ||
| workflows/ | ||
| lint.yml # Lint and format check on PRs and pushes to main | ||
| release-changesets.yml # Reusable: versioning and npm publishing via Changesets | ||
| auto-merge-dependabot.yml # Reusable: approve and merge Dependabot PRs by semver | ||
| ISSUE_TEMPLATE/ # Issue form templates |
There was a problem hiding this comment.
There are still references to the removed auto-merge-dependabot workflow under docs/superpowers/plans/2026-03-30-code-quality-linting.md (e.g., the actionlint task and the directory tree snippet). To avoid stale docs and to match the PR’s “no remaining references” test plan, update that doc (or clarify that docs/ is intentionally out of scope).
Summary
.github/workflows/auto-merge-dependabot.ymlreusable workflowREADME.mdandAGENTS.mdAuto-approving and merging Dependabot PRs is a supply-chain attack vector — a compromised upstream package with a semver patch bump gets merged without human review. Dependabot PRs should be reviewed manually or via Claude Code CI review (which approves but does not auto-merge).
Caller workflows in
eslint-config,prettier-config,stylelint-config, andcommitlint-configare not updated as those repos are archived.Closes #18
Test plan
auto-merge-dependabotin active files