From 4fffcad2895278b2ae63f088f71de5ee5308fc98 Mon Sep 17 00:00:00 2001 From: Dusten Hubbard Date: Tue, 1 Sep 2026 14:25:16 -0500 Subject: [PATCH] ci(dependabot): comment on a major bump once, not on every push The step had no event filter, so it ran on `synchronize` as well as `opened`, and Dependabot pushes a rebase moments after opening a pull request. Three of the five majors opened on 2026-09-01 carry the comment twice, and a long-lived pull request would collect one per rebase for as long as it stayed open. The auto-merge step above it stays on every event on purpose: `gh pr merge --auto` is idempotent, so re-running it re-arms a pull request whose auto-merge has been cleared. --- .github/workflows/dependabot-auto.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto.yml b/.github/workflows/dependabot-auto.yml index 0ea2b6e6..6a429fb1 100644 --- a/.github/workflows/dependabot-auto.yml +++ b/.github/workflows/dependabot-auto.yml @@ -29,8 +29,19 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}" + # Only when the pull request is opened. Without the action check this + # step also ran on `synchronize`, which is every push Dependabot makes to + # a branch it already opened, and Dependabot pushes a rebase moments + # after opening one. So three of the five major bumps opened on + # 2026-09-01 carried this comment twice, and a long-lived pull request + # would collect one per rebase for as long as it stayed open. The + # auto-merge step above is left on every event on purpose: `gh pr merge + # --auto` is idempotent, and re-running it re-arms a pull request whose + # auto-merge was cleared. - name: leave a major bump for a maintainer - if: steps.meta.outputs.update-type == 'version-update:semver-major' + if: | + github.event.action == 'opened' && + steps.meta.outputs.update-type == 'version-update:semver-major' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: |