RFC: Automerging dependabot PRs

[jamesgorrie]

We would like to have automerging of @dependabot PRs.

When and which SemVer version type are considerations we should have when implementing this.

Other teams are also doing this

Reading

https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enable-auto-merge-on-a-pull-request

[jamesgorrie]

SemVer type: Major version automerging

[mxdvl]

I think it’s good to have visibility on those, so I would not want to have them merged automatically.

[jamesgorrie]

SemVer type: Minor / patch version automerging

[mxdvl]

There are a few packages that don’t strictly follow SemVer, such as aws-cdk. We need to filter these out.
Otherwise, I think this is a safe operation, provided all CI passes.

[jamesgorrie]

When: Core hours + an indication that there are people about e.g. a certain amount or a "Good morning" thread in team chat.

[mxdvl]

An alternative would be combining all dependabot PRs and then require a single manual click: https://github.com/hrvey/combine-prs-workflow

[jamesgorrie]

When: core hours with a buffer i.e. 11 - 16, Monday to Thursdays excluding holidays.

[mxdvl]

I think we should run at a specific time on specific days.

I would suggest Tue & Thu @ 11am & 3pm.

[DavidLawes]

In the example provided I notice auto-merging was being suggested for dev-dependencies only, is this something we could consider? Auto merging dev dependencies only would come with much less risk (?), so it could be a good starting point?

[mxdvl]

Sadly we no longer have this distinction between dependency types, since #4050

[SiAdcock]

Does Chromatic get triggered on dependabot PRs? I'd feel more confident if Chromatic could run on verbumps to visual libraries like React, Emotion and Source.

[mxdvl]

Yes, Chromatic runs all the time!