From 30ddd4e1b36a6f4d04bbd180ee36d15b96d55985 Mon Sep 17 00:00:00 2001
From: Rob Adams Jr <crazypants010@gmail.com>
Date: Wed, 9 Sep 2026 01:28:58 -0500
Subject: [PATCH] Auto-merge only Dependabot's own minor/patch group PRs

The guard let through any PR whose update-type was not semver-major. For
a requirement range with no lockfile, Dependabot emits no update-type,
and fetch-metadata reported Claude-Patent-Creator #82 (mcp widened from
<2.0.0 to <3.0.0) as version-update:semver-patch. A major landed on main
by itself and broke that server at import.

Dependabot decides group membership from versions it can actually
compare, so the group name is the trustworthy signal. The guard now
merges only PRs in a *-minor-patch group. Majors, range widens, and
anything Dependabot could not classify wait for a person.

- security-minor-patch group so minor/patch security fixes still flow
  on their own.
- actions-minor-patch group so GitHub Actions bumps keep auto-merging.
---
 .github/dependabot.yml                      | 13 ++++++++++++-
 .github/workflows/dependabot-auto-merge.yml | 10 ++++++++--
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1d1a973..1ef0f6d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,6 +18,12 @@ updates:
       include: "scope"
     groups:
       all-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+      security-minor-patch:
+        applies-to: security-updates
         update-types:
           - "minor"
           - "patch"
@@ -36,4 +42,9 @@ updates:
       - "github-actions"
     commit-message:
       prefix: "ci"
-      include: "scope"
\ No newline at end of file
+      include: "scope"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index f32825c..630a424 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -12,8 +12,14 @@ jobs:
     steps:
       - uses: dependabot/fetch-metadata@v3
         id: meta
-      - name: Auto-merge patch and minor updates
-        if: steps.meta.outputs.update-type != 'version-update:semver-major'
+      - name: Auto-merge Dependabot's minor/patch group PRs
+        # Merge only PRs Dependabot itself filed as a minor/patch group. Group
+        # membership is decided from versions Dependabot could actually compare;
+        # anything outside a group is a major, a security update, or a
+        # requirement range it could not classify. fetch-metadata's update-type
+        # is not a safe gate for those: Claude-Patent-Creator #82 widened mcp
+        # from <2.0.0 to <3.0.0 and it reported "version-update:semver-patch".
+        if: endsWith(steps.meta.outputs.dependency-group, 'minor-patch')
         run: gh pr merge "$PR_URL" --auto --squash
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}