Dependabot helps you keep your dependencies up-to-date by automatically opening pull requests for outdated dependencies. When combined with Mergify, you can automate parts of the process even further, ensuring your projects stay current with minimal manual intervention.
Automating Dependabot Pull Request MergesSection titled Automating Dependabot Pull Request Merges
There are two primary ways to automate the merging of Dependabot PRs with Mergify:
1. Direct Merge or Merge QueueSection titled 1. Direct Merge or Merge Queue
You can set up a pull request rule to automatically merge Dependabot PRs or place them in the merge queue.
2. PR ApprovalSection titled 2. PR Approval
If you have GitHub’s branch protection set up to require approvals, you can use Mergify to automatically approve Dependabot PRs.
Filtering Dependabot PRsSection titled Filtering Dependabot PRs
Dependabot provides specific labels for the type of dependency update, such as
dependabot-update-type. You can use these labels in your Mergify rules to
filter which Dependabot PRs to auto-merge. For instance, you might only want to
auto-merge minor version bumps:
Batching Dependency UpdatesSection titled Batching Dependency Updates
For projects where there are frequent updates to a large number of small libraries, it’s efficient to batch these updates together. Using Mergify’s merge queue feature, you can automatically batch and test these updates together, reducing CI load and ensuring compatibility.
For example, you could set up a merge queue to batch those PRs 10 by 10:
Disable Dependabot’s Automatic RebaseSection titled Disable Dependabot’s Automatic Rebase
By default, Dependabot will try to rebase its pull requests every time there’s a new commit to the main branch. In high-velocity projects with a lot of update, this can lead to unnecessary CI runs. It’s recommended to disable Dependabot’s automatic rebase feature and instead rely on Mergify to queue and merge these updates efficiently.
To disable automatic rebasing in Dependabot, use the
settings and turn off automatic rebase.
With Mergify and Dependabot working together, you can ensure your project’s dependencies are always up-to-date with minimal effort, ensuring a smooth and efficient update process.