fix(ci): Dependabot and Mergify configuration is stale and dependency PRs cannot auto-merge #3476

Activity

1. eleshar

   added

   priority:high

   area:builds

   type:bug

   on Sep 23, 2026
2. linear-code commented on Sep 23, 2026

   

   linear-codeBot

   on Sep 23, 2026 – with Linear Code

   More actions

   LS-4240
3. github-actions

   added

   status:needs-triage

   on Sep 23, 2026
4. eleshar commented on Sep 23, 2026

   

   eleshar

   on Sep 23, 2026

   ContributorAuthor

   More actions

   #3477 covers the Dependabot, Mergify and template-routing changes listed here. Five of the manifests listed (release-agent, hooks, scripts/metrics, scripts/telemetry, skills/lsx-wp-design-system-v2) have no dependencies, so they are not watched.

   Still open, for an owner: may Dependabot patch/minor PRs merge without a human code-owner review (for example a ruleset bypass for Mergify)? Until that is decided, auto-merge still needs a code-owner approval, so this issue stays open.
5. eleshar commented on Sep 23, 2026

   

   eleshar

   on Sep 23, 2026

   ContributorAuthor

   More actions

   Decision (Chris, 2026-09-23): human code-owner approval stays required for every Dependabot PR until tests run as a required check. Then only grouped minor/patch updates may merge automatically; majors always need a person. PR for the schedule change and recorded policy: #3515.

   Facts it rests on:

   • develop's required checks are Route PR template and apply labels, Validate changelog on PR and actionlint. None runs tests.
   • A workflow approval with GITHUB_TOKEN comes from github-actions[bot], which is not a code owner, so it cannot satisfy require_code_owner_review.
   • A ruleset bypass skips every rule in the ruleset, required checks included.

   Step 3, to apply once #3487 has merged and its Jest check is added to the ruleset's required checks:

   1. Add the Mergify GitHub App as a bypass actor on develop-branch-ruleset: actor_type: Integration, bypass_mode: pull_request.
   2. Replace merge_protections_settings.auto_merge_conditions in .github/mergify.yml with explicit conditions, because the bypass no longer enforces them:

      auto_merge_conditions:
        - author~=^(dependabot\[bot\]|app/dependabot)$
        - base=develop
        - head~=^dependabot/.+/(npm|github-actions)-minor-patch
        - check-success=Route PR template and apply labels
        - check-success=Validate changelog on PR
        - check-success=actionlint
        - check-success=<Jest check name from #3487>
        - -conflict

   3. Check Mergify's configuration check passes, then watch the first grouped PR merge.

   Separately, the org setting gives every workflow token write by default with can_approve_pull_request_reviews: true, across all 339 repos. The repo-level setting cannot override it. Tracked in its own issue.
6. eleshar

   added 3 commits that reference this issue on Sep 25, 2026

   fix: describe the weekly dependency update schedule (#3476)

   ...

   d8c4eea

   fix: keep the changelog entry clear of banned implementation terms (#…

   ...

   c2f30e1

   ci: dependabot - weekly npm updates and record the merge policy (#3515)

   ...

   25179a5
7. eleshar commented on Sep 26, 2026

   

   eleshar

   on Sep 26, 2026

   ContributorAuthor

   More actions

   New evidence, and the picture has shifted since this issue was written. Still looks like the right home for it.

   Current state of the Mergify side (2026-09-26)

   Two of the findings above have since changed:

   • The check-success=All Checks Passed gating is gone. ci(mergify): keep stale pull requests current with develop #3563 removed the queue, auto-approve, imgbot and meta-agent rules; the only surviving mechanism is merge_protections_settings.auto_merge_conditions with author~=^(dependabot\[bot\]|app/dependabot)$.
   • The queue rule is gone too, and there is no merge_protections: rule in the file. .github/mergify.yml is 100 lines and ends at auto_merge_conditions.

   Auto-queue now reports as a permanently failing protection

   On a Dependabot pull request, Mergify posts a Merge Protections summary showing 1 of 2 protections blocking:

   • 🔴 Auto-queue — "This rule is failing." Condition author=~^(dependabot|bot)\[app\]|app/dependabot$
   • 🟢 Configuration Change Requirements — satisfied

   The config already predicts this. Its own comment says:

   This is inert unless a merge_protections rule below matches the PR, or the merge queue is enabled: with no matching rule there are no success_conditions to evaluate... Left as-is deliberately.

   Both enabling conditions are now false — the queue rule was removed in #3563 and no merge_protections rule was added. So auto_merge_conditions can never fire, while Mergify still surfaces Auto-queue as a failing protection on every Dependabot PR.

   That matches the earlier finding here that Dependabot PRs were being merged through auto_merge_conditions despite the required check failing: the setting is doing nothing except producing a red X. All 13 currently open Dependabot PRs are BLOCKED; #3514 is UNKNOWN.

   What this adds to the issue

   The root cause is unchanged and still the owner decision already flagged here: develop requires a code-owner approval, Mergify's approval is not a code-owner review, so bot PRs need a human regardless. What is new is that the configuration is now provably inert, so it is not a possible route to auto-merge — only a source of noise.

   Worth deciding explicitly, rather than leaving a setting that cannot work:

   • Make the queue or a merge_protections rule real, if auto-queue is wanted; or
   • Remove auto_merge_conditions and the Auto-queue noise, if it is not, and accept human approval as the gate.

   Not filing separately — it is the same defect this issue already tracks.