dependabot-manager

Automated dependency updates and auto-merge policies across multiple GitHub repositories are enforced by applying centralized Dependabot rules that merge patches and minors based on CI status, while requiring manual review for major updates.

Yes, you can auto-merge minor and patch dependency updates while requiring manual review for major version bumps by enforcing governance policies that evaluate update types and CI status before triggering automated merges.

Handling Dependabot security advisories without automatically merging breaking changes is achieved by implementing a governance workflow that mandates manual review for major updates and security alerts, ensuring safe dependency management.

This dependency management approach works with existing GitHub Actions CI/CD pipelines by integrating auto-merge decisions directly with CI status checks and repository security policies to provide scalable and safe update workflows.

Centralized configuration for Dependabot auto-merge rules is needed to provide scalable governance across multiple repositories, ensuring consistent enforcement of patch and minor auto-merges while maintaining security policies for major version changes.