Auto-merge only Dependabot's own minor/patch group PRs

[RobThePCGuy]

Why

In Claude-Patent-Creator, Dependabot PR #82 widened a pin from <2.0.0 to <3.0.0 and was auto-merged, breaking the server at import. The auto-merge guard here is the same one: it checks update-type != semver-major, but for a requirement range with no lockfile Dependabot writes no update-type, and fetch-metadata reported that 1.x to 2.x widen as version-update:semver-patch. A version-type guard cannot be trusted for those PRs.

Change

Dependabot decides group membership from versions it can actually compare, so the group name is the honest signal. The workflow now auto-merges only PRs whose dependency-group ends in minor-patch. Majors, range widens, and anything Dependabot could not classify sit open until a person merges them.

• security-minor-patch (applies to security updates) so minor/patch security fixes still merge on their own.
• actions-minor-patch so GitHub Actions bumps keep auto-merging.

Summary by CodeRabbit

• Chores
  • Dependency updates are now grouped more clearly by package type and release level.
  • GitHub Actions updates receive dedicated minor-and-patch grouping.
  • Automatic merging is limited to eligible minor-and-patch dependency groups; major, security, and unclassified updates require manual review.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 22e9d618-891a-4543-820f-01f481b3f219

📥 Commits

Reviewing files that changed from the base of the PR and between 7002d18 and 30ddd4e.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/dependabot-auto-merge.yml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

Dependabot now groups minor and patch updates for pip and GitHub Actions. The auto-merge workflow merges only updates in groups whose names end with minor-patch.

Changes

Dependabot automation

Layer / File(s)	Summary
Define minor-patch update groups .github/dependabot.yml	Dependabot groups pip minor and patch updates, pip security updates, and GitHub Actions minor and patch updates.
Restrict auto-merge to grouped updates .github/workflows/dependabot-auto-merge.yml	The workflow auto-merges only pull requests whose dependency-group ends with minor-patch. Major, security, and unclassified updates are excluded.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 30ddd

Dependabot now auto-merges only grouped minor and patch updates, preventing major, security, and unclassified updates from merging automatically. No current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: auto-merging only Dependabot pull requests in the minor/patch group.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/dependabot-group-guard

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T06:32:46.163871Z	30ddd4e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.