Repository navigation
fix: restrict automatic PR approval and merging to Dependabot - #12402
Merged
Timothee Guerin (timotheeguerin) merged 1 commit intoOct 26, 2026
Conversation
![microsoft-github-policy-service[bot]](https://avatars.githubusercontent.com/in/95686?s=60&v=4){kind=small}
microsoft-github-policy-service
Bot
added
auto-merge
Timothee Guerin (timotheeguerin)
marked this pull request as ready for review
October 26, 2026 12:38
Timothee Guerin (timotheeguerin)
requested review from
catalinaperalta,
iscai-msft,
Laurent Mazuel (lmazuel) and
Mark Cowlishaw (markcowl)
as code owners
October 26, 2026 12:38
Contributor
|
No changes needing a change description found. |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The single-condition fix addresses the reported regression without changing existing safeguards, and no unresolved issues remain.
No open issues 🎉
What changed in this PR
Fixes the policy regression introduced in #12129 by restricting automatic approval, labeling, and auto-merge to Dependabot PRs targeting main.
Changes:
- Sets
issueAuthor: falseso sender matching uses the configureddependabot[bot]login. - Preserves existing event and branch restrictions; existing approvals, labels, and auto-merge requests remain unchanged.
| File | Description |
|---|---|
.github/policies/pr.dependabot-auto-merge.yml |
Corrects the sender condition to limit automation to Dependabot. |
Review effort: Balanced
Timothee Guerin (timotheeguerin)
enabled auto-merge
October 26, 2026 13:05
|
You can try these changes here
|
iscai-msft
approved these changes
Oct 26, 2026
Timothee Guerin (timotheeguerin)
deleted the
fix/dependabot-policy-author-filter
branch
October 26, 2026 16:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Dependabot policy currently approves and enables auto-merge for human-authored PRs too. For example, the policy approved microsoft/typespec#12395 despite it not being a Dependabot PR.
issueAuthor: truemakes the sender condition match the PR author rather than restrict it to the configured bot login. Set it tofalseso approval, labeling, and auto-merge remain limited to Dependabot PRs targetingmain.Fixes a regression introduced by #12129. Existing approvals, labels, and auto-merge requests are not retroactively removed.