Automate Dependabot merges after CodeRabbit approval

[acgetchell]

Goal

Automatically squash-merge Dependabot updates only after CodeRabbit approves them and every protected-branch requirement passes.

Current state

• Repository auto-merge and automatic head-branch deletion are already enabled.
• The active main ruleset already requires CodeRabbit and the existing CI/SARIF checks with strict status-check enforcement.
• Required approvals are currently 0.
• Required review-thread resolution is currently disabled.
• .coderabbit.yaml has request_changes_workflow: true and commit_status: true, but fail_commit_status: false.
• Cargo and uv updates are grouped, but GitHub Actions updates are not.
• No Dependabot review/auto-merge workflow exists.
• Default Actions permissions are read-only; workflows may request explicit job permissions. Actions should not approve reviews—CodeRabbit should.

Implementation

• Set reviews.fail_commit_status: true in .coderabbit.yaml so a skipped or failed CodeRabbit review blocks merging.
• Add a github-actions group matching "*" to .github/dependabot.yml, preserving the existing Cargo and uv groups.
• Create or reuse a fine-grained PAT owned by acgetchell; grant it access to this repository with Issues: read and write and Pull requests: read and write repository permissions, with no user permissions. Store it in this repository as the Dependabot secret CODERABBIT_REVIEW_TOKEN. The same PAT may be reused across rollout repositories when its repository access includes each one, but configure the Dependabot secret separately in every repository. Do not use an Actions secret; Dependabot-triggered workflows receive Dependabot secrets.
• Add .github/workflows/dependabot-auto-merge.yml using this repository-specific workflow:

name: Dependabot review and auto-merge

on:
  pull_request:
    types:
      - opened
      - reopened
      - ready_for_review
      - synchronize

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write

jobs:
  review-and-enable-auto-merge:
    if: >-
      github.event.pull_request.user.login == 'dependabot[bot]' &&
      github.repository == 'acgetchell/la-stack'
    runs-on: ubuntu-latest
    steps:
      - name: Request CodeRabbit review
        env:
          # Dependabot-triggered workflows receive Dependabot secrets.
          GH_TOKEN: ${{ secrets.CODERABBIT_REVIEW_TOKEN }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          REPOSITORY: ${{ github.repository }}
        run: |
          if [[ -z "$GH_TOKEN" ]]; then
            echo "::error::CODERABBIT_REVIEW_TOKEN is not configured."
            exit 1
          fi

          token_owner="$(gh api user --jq '.login')"
          if [[ "$token_owner" != "acgetchell" ]]; then
            echo "::error::CODERABBIT_REVIEW_TOKEN must belong to acgetchell."
            exit 1
          fi

          marker="<!-- coderabbit-review-request:${PR_HEAD_SHA} -->"
          comments="$(
            gh api --paginate \
              "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" \
              --jq '.[] | select(.user.login == "acgetchell") | .body'
          )"
          if grep -Fxq -- "$marker" <<< "$comments"; then
            echo "CodeRabbit review already requested for ${PR_HEAD_SHA}."
            exit 0
          fi
          body="$(printf '@coderabbitai review\n\n%s' "$marker")"
          gh api \
            --method POST \
            "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" \
            --raw-field body="$body"

      - name: Enable auto-merge
        env:
          GH_TOKEN: ${{ github.token }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: gh pr merge --auto --squash --match-head-commit "$PR_HEAD_SHA" "$PR_URL"

• After the checked-in automation reaches main, update ruleset main:
  • require exactly one approving review;
  • enable required review-thread resolution;
  • keep code-owner and last-push approval requirements disabled;
  • keep strict status checks enabled;
  • preserve deletion, non-fast-forward, bypass actors, merge methods, and every existing required check;
  • keep CodeRabbit required and bind it to the CodeRabbit GitHub App when the settings/API supports that binding.
• Leave repository Actions approval permission disabled; the workflow requests review and enables auto-merge but does not approve its own PR.

Acceptance criteria

• A new Dependabot PR receives an explicit @coderabbitai review request authored by acgetchell and has squash auto-merge enabled.
• Updating a Dependabot head reruns the workflow, and overlapping runs for the same pull request cancel.
• A review request is deduplicated only for an exact head-SHA marker posted by acgetchell.
• Auto-merge is armed only for the head commit that triggered the workflow.
• It cannot merge while CodeRabbit is pending, skipped, failed, or requesting changes.
• It cannot merge until CodeRabbit has approved, all existing required checks pass on the latest base, and all review threads are resolved.
• Human-authored PRs keep the same CodeRabbit-required workflow.
• Existing required checks and ruleset bypasses remain unchanged.

Validation

• Run the repository's documented YAML/configuration checks, including actionlint and workflow security validation.
• Verify the live ruleset after updating it.
• Open or reopen a Dependabot PR and confirm the token-backed request starts CodeRabbit without manual intervention, then CodeRabbit approval plus all protected checks results in automatic squash merge.