A GitHub Action that automatically approves and merges pull requests from bots like Dependabot when CI checks pass.
Merge Me! Action is a GitHub Action that automatically approves and merges pull requests, especially those from dependency update bots like Dependabot. It ensures merges only happen when all required CI checks pass, integrating seamlessly with GitHub's branch protection rules to maintain code quality and security.
Development teams and DevOps engineers using GitHub Actions who want to automate the merging of dependency update PRs and reduce manual workflow overhead.
It provides a secure, configurable, and CI-aware automation solution that respects branch protection rules, supports multiple merge strategies, and includes presets for semantic version filtering, making dependency updates more efficient.
Automatically merges Pull Requests.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Respects GitHub branch protection rules and provides secure trigger setups for public and private repositories, with README warnings about risks like pwn requests, ensuring merges only proceed after CI checks pass.
Supports multiple GitHub Actions triggers—check_suite, pull_request_target, and workflow_run—allowing adaptation to different CI workflows, as detailed in usage examples for public and private repos.
Configurable via GITHUB_LOGIN with micromatch patterns to target specific bots beyond Dependabot, such as dependabot-preview, enhancing versatility for various automation scenarios.
Includes exponential backoff retries for failed merges, configurable via MAXIMUM_RETRIES, which helps handle transient API or network issues without manual intervention.
Offers presets like DEPENDABOT_MINOR and DEPENDABOT_PATCH to merge only specific types of dependency updates, reducing risk by adhering to semantic versioning principles.
Requires careful configuration to avoid security vulnerabilities with triggers like pull_request_target, as highlighted in README warnings, leading to a steep learning curve and potential missteps.
Exclusively designed for GitHub Actions and reliant on GitHub-specific APIs, making it unsuitable for teams using other version control or CI platforms like GitLab or Bitbucket.
To enforce strict branch protection rules, it must enable GitHub preview APIs via ENABLE_GITHUB_API_PREVIEW, which are unstable and subject to change, introducing maintenance risks.
For protected branches, it necessitates a custom token (GITHUB_TOKEN_WORKAROUND) instead of the default GITHUB_TOKEN, adding administrative complexity and secret management burden.