Dependabot-core: Automatic PR merging with branch protection rules

[bennycode]

In my GitHub repository I protected the "master" branch so that it requires pull request reviews before merging. This now stops Dependabot from automatic PR merging because it needs a pull request review first.

I cannot add Dependabot to the list of people who can dismiss pull request reviews because it's an integration and not a user.

Can I add Dependabot to the list of code owners so that it can approve it's own PR?

My goal is to achieve that Dependabot can auto merge dependency updates while other contributors still need an approval to merge PRs.

[feelepxyz]

@bennyn 👋 there's no straight forward fix for this, unfortunately. You could use an Action to auto-approve PRs from dependabot and get around it that way. Here's one: https://github.com/hmarr/auto-approve-action

Dependabot currently can't approve its own PRs.

[Negan1911]

Hello @feelepxyz I'm actually using auto-approve-action. But something weirds happens to me on the combination of dependabot + that action.
I already had enabled "Treat PR approval as a request to merge", and, on a dependabot PR, if that action approves the PR, dependabot is not triggered to merge it. But as soon as I approve it, dependabot merges it. Any idea why?

[ZebraFlesh]

I've successfully added the dependabot-preview app to my code owners file. Combined with the auto-approve-action, dependabot can now auto merge PRs to my protected branch.