# Dependabot auto-merge workflow (prometheus/prometheus)

> The Dependabot auto-merge workflow from prometheus/prometheus, explained and optimized by Latchkey.

Source: https://latchkey.dev/workflows/prometheus-prometheus-automerge-dependabot  
Upstream: [prometheus/prometheus](https://github.com/prometheus/prometheus/blob/main/.github/workflows/automerge-dependabot.yml) (.github/workflows/automerge-dependabot.yml), licence Apache-2.0

## What it does

This is the Dependabot auto-merge workflow from the prometheus/prometheus repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

## The workflow

```yaml
---
name: Dependabot auto-merge
on: pull_request

concurrency:
  group: ${{ github.workflow }}-${{ (github.event.pull_request && github.event.pull_request.number) || github.ref || github.run_id }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  dependabot:
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.repository_owner == 'prometheus' }}
    steps:
    - name: Dependabot metadata
      id: metadata
      uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
      with:
        github-token: "${{ secrets.GITHUB_TOKEN }}"
    - name: Enable auto-merge for Dependabot PRs
      if: ${{steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
      run: gh pr merge --auto --merge "$PR_URL"
      env:
        PR_URL: ${{github.event.pull_request.html_url}}
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
```

## FAQ

### What does the Dependabot auto-merge workflow (prometheus/prometheus) workflow do?

This is the Dependabot auto-merge workflow from the prometheus/prometheus repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

### What CI health grade does this workflow get?

This Automation and other workflow grades A. Paste your own workflow into the Latchkey grader to see its grade and the exact fixes.

### How can I improve this Automation and other workflow?

Add job timeouts. Latchkey applies these automatically on managed runners when you point runs-on at Latchkey.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt