ci: auto-merge Dependabot patch and minor updates with merge-capable token

[hassiebp]

What does this PR do?

Dependabot auto-merge has never worked in this repo: every patch-level run fails at gh pr merge --auto with
GraphQL: Pull request User is not authorized for this protected branch (enablePullRequestAutoMerge) (e.g. runs 38595465808 for #1997, 38689442644 for #2004). main restricts who may push, and GITHUB_TOKEN (github-actions) is not on that list.

Changes to .github/workflows/dependabot-merge.yml (same logic as langfuse/langfuse-js#1044):

• gh pr merge --auto --squash now authenticates with secrets.GH_TOKEN_DEPENDABOT_JS_PY (a fine-grained PAT stored as a Dependabot secret — Dependabot-triggered pull_request runs only receive Dependabot secrets).
• The decision is made per dependency from updated-dependencies-json: auto-merge only if every updated dependency is a patch, or a minor whose previous version does not start with 0. (optional v prefix). Majors and 0.x minors (breaking under semver, e.g. ruff<0.16, uv_build<0.12) stay manual. Checking per dependency matters for grouped PRs, where previous-version only reflects the first dependency.
• If a PR is not eligible but already has auto-merge enabled (e.g. a grouped PR that gained a manual update after a rebase), auto-merge is disabled again.
• GITHUB_TOKEN is reduced to contents: read + pull-requests: read (only fetch-metadata uses it); workflow-level permissions: {}.

Auto-merge still waits for the required checks (all-tests-passed, license/cla, CodeQL, Check GitHub Actions security). Grouped GitHub Actions PRs touch .github/ and still need a code-owner review, so they will not merge on their own.

This PR touches .github/, so it needs a review from @langfuse/maintainers (CODEOWNERS).

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor
• Documentation update
• Tooling, CI, or repo maintenance

Verification

uvx zizmor --offline --min-severity low .github/workflows/          # No findings (same as CI config)
uvx zizmor --min-severity low .github/workflows/dependabot-merge.yml # online audits: no findings
uvx zizmor --persona pedantic .github/workflows/dependabot-merge.yml # main: 2 high excessive-permissions -> this branch: 0 high

The jq decision was run locally against sample updated-dependencies-json payloads: 0.x patch → merge, 2.x minor → merge, 0.x / v0.x minor → manual, major → manual, group with a 0.x minor second → manual, group of patch + 1.x minor → merge, empty or missing output → manual.

The workflow itself can only run on a Dependabot PR, so it cannot be exercised before merge. After merge, verify on the next Dependabot patch/minor PR (or @dependabot recreate an existing one, e.g. #1916 urllib3 2.7.0→2.8.0):

1. The Dependabot auto-merge run succeeds with "Enable auto-merge" executed (not skipped).
2. gh pr view <N> -R langfuse/langfuse-python --json autoMergeRequest shows autoMergeRequest set (enabled by the PAT owner).
3. The PR merges once required checks pass. A major or 0.x minor bump should run "Disable auto-merge" instead and have no autoMergeRequest.

Checklist

• I self-reviewed the diff using code_review.md.
• I added or updated tests for behavior changes. (n/a — workflow only)
• I updated docs, examples, or .env.template if needed. (n/a)
• I did not hand-edit generated files; if generated files changed, I used the upstream regeneration path.
• I did not commit secrets or credentials.

  

Confidence Score: 5/5

The PR appears safe to merge; no actionable issues were found.

Summary

Updates Dependabot auto-merge to use a dedicated merge-capable token.

• Dependabot patch and minor updates can request auto-merge.

_{Reviews (1) · Last reviewed commit: "ci: auto-merge Dependabot patch and mino..." · Reviewed by Greptile}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T11:51:49.044983Z	df130e3	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

@claude review

[claude]

Claude Code Review

No review was started: this request came from a bot account. Manual reviews can only be requested by someone with write access to this repository. Ask a maintainer to comment @claude review, or have your automation post the comment from a user account with write access.

_{Tip: disable this comment in your organization's Code Review settings.}

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Besides the inline finding, I checked how the new PAT is exposed. The job never checks out or runs PR code. PR_URL is passed through env rather than written into the run script, so the PR can't inject anything there. The job only runs when the PR author's user id is 49699333 (dependabot[bot]), so other PRs never reach the step that holds the token.

Extended reasoning...

The PR changes only .github/workflows/dependabot-merge.yml: it narrows the GITHUB_TOKEN permissions, adds semver-minor to auto-merge, and swaps in a repository secret token for the merge step. That makes it CI and credential-handling surface. I examined how the PAT could leak or be misused (checkout, script injection, the author gate) and found no path. The 0.x minor-bump finding is already posted inline.