Automatically merging Dependabot security pull requests using GitHub Actions
Dependabot is a tool for automated dependency updates. It creates pull requests for each dependency update, and GitHub uses it for security updates. The problem is you still need to merge these pull requests. Using GitHub Actions, we can merge pull requests from Dependabot automatically.
To do that, create a new workflow file, .github/workflows/dependabot.yml:
This will approve and merge all pull requests from Dependabot bot.
I’ve also created an Mrm task to add this workflow with a single command:
npx mrm dependabot.
Based on the article by Toufik Airane.