Automate Dependabot PR handling with Copilot coding agent - #2732
Merged
Akanksha Jain (jainakanksha-msft) merged 3 commits intoAug 13, 2026
Conversation
Dependabot only bumps versions and can't fix breakage, add tests, or update the changelog on its own. This wires in GitHub Copilot's coding agent to do that work automatically, then auto-merges once CI passes and a maintainer approves: - dependabot-auto-merge.yml: approve and enable auto-merge for Dependabot PRs once required checks pass. - copilot-dependabot-agent.yml: comment @copilot with a checklist (impact analysis, build/conflict fixes, tests, changelog, comment review, self-rating) on every new/updated Dependabot PR. - dependabot-conflict-recheck.yml: after any merge to main, re-assign Copilot to any open Dependabot PR that now conflicts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Copilot started reviewing on behalf of
Akanksha Jain (jainakanksha-msft)
August 13, 2026 07:36
View session
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds GitHub Actions workflows and a Copilot instruction template to automate handling of Dependabot PRs: dispatching Copilot’s coding agent to prepare PRs, re-dispatching when PRs become conflicting, and enabling squash auto-merge for Dependabot PRs after checks pass.
Changes:
- Add an auto-merge workflow that approves Dependabot PRs and enables squash auto-merge.
- Add a workflow that comments
@copilotinstructions on Dependabot PRs (and supports manual re-dispatch). - Add a post-merge recheck workflow that re-dispatches Copilot on any open Dependabot PRs that are now conflicting.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/dependabot-auto-merge.yml | Approves Dependabot PRs and enables squash auto-merge via gh once checks pass. |
| .github/workflows/copilot-dependabot-agent.yml | Dispatches Copilot by posting a PR comment with the instruction template. |
| .github/copilot-dependabot-instructions.md | Defines the standardized checklist Copilot should follow on Dependabot PRs. |
| .github/workflows/dependabot-conflict-recheck.yml | On pushes to main, finds conflicting Dependabot PRs and re-dispatches the Copilot workflow. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+21
to
+23
| gh pr list --repo "$GITHUB_REPOSITORY" --author "app/dependabot" --state open \ | ||
| --json number,mergeable --jq '.[] | select(.mergeable == "CONFLICTING") | .number' \ | ||
| | while read -r n; do |
Comment on lines
+14
to
+18
| - name: Dependabot metadata | ||
| id: metadata | ||
| uses: dependabot/fetch-metadata@v2 | ||
| with: | ||
| github-token: "${{ secrets.GITHUB_TOKEN }}" |
Comment on lines
+30
to
+34
| - name: Ask Copilot to work the PR | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| PR_NUMBER: ${{ steps.pr.outputs.number }} | ||
| run: gh pr comment "$PR_NUMBER" --body-file .github/copilot-dependabot-instructions.md |
Hold off on auto-merge until the Copilot agent's output has been reviewed over a few iterations of real Dependabot PRs.
Copilot started reviewing on behalf of
Akanksha Jain (jainakanksha-msft)
August 13, 2026 07:45
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (3)
.github/workflows/copilot-dependabot-agent.yml:34
gh pr comment ... --body-file .github/copilot-dependabot-instructions.mdwill fail because the workflow never checks out the repository, so the body file (and even the repo context forgh) is not available on the runner. Add a checkout step (or otherwise fetch the file), and pass--repofor robustness when not in a git worktree.
- name: Ask Copilot to work the PR
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ steps.pr.outputs.number }}
run: gh pr comment "$PR_NUMBER" --body-file .github/copilot-dependabot-instructions.md
.github/workflows/dependabot-conflict-recheck.yml:21
gh pr list --author "app/dependabot"is unlikely to match Dependabot PRs because--authorfilters by user, while Dependabot is a GitHub App. Use--app dependabotto reliably list Dependabot-authored PRs.
gh pr list --repo "$GITHUB_REPOSITORY" --author "app/dependabot" --state open \
.github/workflows/copilot-dependabot-agent.yml:5
- PR description says it adds
dependabot-auto-merge.yml, but that workflow file is not present in this change set. Either add the missing workflow, or update the PR description so it matches what’s actually being proposed.
name: Copilot Dependabot Agent
on:
pull_request:
types: [opened, synchronize, reopened]
- copilot-dependabot-agent: checkout the repo before posting the instructions comment, since --body-file needs the file on disk; pin GH_REPO explicitly too. - dependabot-conflict-recheck: match Dependabot PRs with --app dependabot instead of --author (it's a GitHub App, not a user), and set an explicit --limit so PRs past the default 30 aren't silently skipped.
Copilot started reviewing on behalf of
Akanksha Jain (jainakanksha-msft)
August 13, 2026 07:55
View session
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
Suppressed comments (1)
.github/workflows/dependabot-conflict-recheck.yml:26
- The
gh pr list ... | while read ...pipeline can mask failures fromgh pr listbecause GitHub Actions' default bash shell doesn't enablepipefail. Ifgherrors (auth/rate-limit/etc.), the step may still succeed and silently skip redispatching.
run: |
sleep 20
gh pr list --repo "$GITHUB_REPOSITORY" --app dependabot --state open --limit 100 \
--json number,mergeable --jq '.[] | select(.mergeable == "CONFLICTING") | .number' \
| while read -r n; do
Akanksha Jain (jainakanksha-msft)
deleted the
dependabot-copilot-automation
branch
August 13, 2026 10:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
copilot-dependabot-agent.yml+copilot-dependabot-instructions.md: posts a@copilotcomment on every new/updated Dependabot PR asking Copilot's coding agent to do impact analysis, fix build/conflict issues, add/update tests, run the relevant test suites, updateChangeLog.md, address PR comments, self-rate the work, iterate to a 10/10, and post a summary — before the PR is ready for human review.dependabot-conflict-recheck.yml: after any merge tomain, re-dispatches the Copilot agent on any open Dependabot PR that merge knocked into a conflicting state.Auto-merge is intentionally left out of this PR — we'll watch a few iterations of Copilot's output on real Dependabot PRs first, then add an auto-merge workflow in a follow-up once we're comfortable with the quality.
Test plan
@copilotinstructions comment is posted automatically