Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 35.59%. Comparing base (e83db8e) to head (b9fa436).
⚠️ Report is 1 commits behind head on master.

@@           Coverage Diff           @@
##           master     #889   +/-   ##
=======================================
  Coverage   35.59%   35.59%           
=======================================
  Files          36       36           
  Lines        2152     2152           
  Branches      422      417    -5     
=======================================
  Hits          766      766           
+ Misses       1365     1307   -58     
- Partials       21       79   +58     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

Greptile Summary

This PR fixes the broken Dependabot Auto-merge workflow by replacing the defunct ridedott/merge-me-action + expired PAT (AWBOT_GH_TOKEN) path with native GitHub auto-merge via the GraphQL enablePullRequestAutoMerge mutation, using the built-in GITHUB_TOKEN under a workflow_run trigger.

• Removes the ridedott/merge-me-action step and the AWBOT_GH_TOKEN secret dependency, adding explicit contents: write and pull-requests: write permissions instead.
• Adds a actions/github-script step that defensively double-checks the PR is an open, non-draft Dependabot PR via the REST API before issuing the GraphQL mutation, and skips idempotently if auto-merge is already enabled.

Confidence Score: 5/5

Safe to merge — the change removes a dead credential dependency and replaces it with a well-guarded, idempotent native auto-merge call using the built-in GITHUB_TOKEN.

The new workflow correctly uses workflow_run.actor.login rather than github.actor, adds a REST-level double-check before issuing the GraphQL mutation, handles the already-enabled case idempotently, and is pinned to a specific SHA. The permissions block is exactly what enablePullRequestAutoMerge requires.

No files require special attention.

Important Files Changed

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant D as Dependabot
    participant Build as Build Workflow
    participant AM as dependabot-automerge.yml
    participant GHAPI as GitHub REST/GraphQL API

    D->>Build: Opens PR triggers Build
    Build-->>AM: workflow_run completed
    AM->>AM: Check conclusion, actor, pull_requests
    AM->>GHAPI: "GET /repos/.../pulls/{prNumber}"
    GHAPI-->>AM: PR details
    AM->>AM: Skip if not open Dependabot PR or already enabled
    AM->>GHAPI: GraphQL enablePullRequestAutoMerge(SQUASH)
    GHAPI-->>AM: clientMutationId

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant D as Dependabot
    participant Build as Build Workflow
    participant AM as dependabot-automerge.yml
    participant GHAPI as GitHub REST/GraphQL API

    D->>Build: Opens PR triggers Build
    Build-->>AM: workflow_run completed
    AM->>AM: Check conclusion, actor, pull_requests
    AM->>GHAPI: "GET /repos/.../pulls/{prNumber}"
    GHAPI-->>AM: PR details
    AM->>AM: Skip if not open Dependabot PR or already enabled
    AM->>GHAPI: GraphQL enablePullRequestAutoMerge(SQUASH)
    GHAPI-->>AM: clientMutationId

_{Reviews (7): Last reviewed commit: "fix(ci): pin actions/github-script to co..." | Re-trigger Greptile}

@greptileai review

Addressed Greptile's 4/5 nit about the missing in-script null guard on pull_requests[0].

Pushed a052d93 on bob/fix-dependabot-automerge-pat: extracts the array to a named local, returns early with a core.info log when pull_requests is missing or empty, and only then dereferences [0].number. The job-level if expression is unchanged; this is purely a defense-in-depth mirror inside the script body. Re-triggered Greptile for a fresh 5/5.

Ready for Merge ✅

• ✅ CI: All checks green (tests, lints, Greptile review)
• ✅ Greptile: 5/5 (P2 nit addressed in a052d93)
• ✅ No conflicts, mergeable clean state

This PR restores Dependabot auto-merge on master by:

1. Replacing stale AWBOT_GH_TOKEN + ridedott/merge-me-action
2. Enabling native GitHub auto-merge for Dependabot PRs after successful builds
3. Maintaining squash-merge strategy with Dependabot-only guard

Ready for a maintainer to merge.

@greptileai review

Ready for Merge by Maintainer ✅

• ✅ CI: All checks green (tests, lints, Greptile review)
• ✅ Greptile: 5/5 confidence
• ✅ No merge conflicts, mergeable clean state

This PR restores Dependabot auto-merge on master by replacing the stale PAT-based workflow with native GitHub auto-merge. All reviews and feedback addressed.

Waiting for a maintainer with merge permissions to squash-merge.

I recorded work for this monitoring item, but the worker finished before posting the thread update. The delivery guard caught the missing reply and is closing the loop now.

Evidence: commit: abc3bb364f chore(journal): aw-webui#889 Greptile thread closed — null guard reply

Session: fa0b79ec-7984-5b6c-a91f-f78c597c6d7b

@greptileai review