You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Dependabot PRs (e.g. chore(deps): bump body-parser and sails in /samples/sailsjs-postgres/app #763) pass CI (check_samples, deploy_changed_samples, automerge all green) but stay BLOCKED/REVIEW_REQUIRED. The "Main" ruleset requires 1 approving review and lists no required status checks. autoMergeRequest is null, so the current dependabot-automerge.yml (GITHUB_TOKEN approve + gh pr merge --auto) is not producing an approval or enabling auto-merge. The job reports success regardless.
chore(ci): merge all Dependabot updates after CI passes #764 (approved, CLEAN, still open) replaces the workflow with a CI-gated approve+merge. Per its description it needs a DEPENDABOT_AUTOMERGE_TOKEN Actions secret (App/PAT with contents + pull-requests write). I could not confirm whether that secret exists (my token cannot list secrets).
Activity
defangdevs commentedon Oct 30, 2026
Findings (investigated, no code change made):
BLOCKED/REVIEW_REQUIRED. The "Main" ruleset requires 1 approving review and lists no required status checks.autoMergeRequestis null, so the currentdependabot-automerge.yml(GITHUB_TOKEN approve +gh pr merge --auto) is not producing an approval or enabling auto-merge. The job reports success regardless.deploy_changed_samplesfails on fix(mastra): validate generated data and normalize tool limits #765/fix(mastra-extended): retry structured-output validation failures #766 (mastra, mastra-extended):defang ps --jsonexits 5 right after deploy start. This is a different failure from the Dependabot one.DEPENDABOT_AUTOMERGE_TOKENActions secret (App/PAT with contents + pull-requests write). I could not confirm whether that secret exists (my token cannot list secrets).Asks for @lionello:
DEPENDABOT_AUTOMERGE_TOKENsecret, then merge chore(ci): merge all Dependabot updates after CI passes #764.defang psexit-5 failure as a separate issue.lionello commentedon Oct 30, 2026
@defangdevs
defangdevs commentedon Oct 30, 2026
No token is needed for the existing workflow. Elsewhere (defang, portal, etc.) it is the same
dependabot-automerge.yml:GITHUB_TOKENapproves and runsgh pr merge --auto, with repo auto-merge enabled. The samples repo already has that workflow, and it works. Single patch/minor bumps merged this way (chore(deps): bump crass from 1.0.6 to 1.0.7 in /samples/rails/app #749-chore(deps): bump body-parser from 2.3.0 to 2.4.0 in /samples/self-improving/agent #762, merged by github-actions). The open Dependabot PRs are not stuck on a token. chore(deps): bump body-parser and sails in /samples/sailsjs-postgres/app #763 and chore(deps): bump body-parser and express in /starter-sample/app #759 are grouped updates, wherefetch-metadatareturnsupdate-type: null(the run log shows it), so the approve and auto-merge steps are skipped. chore(deps): bump zod from 3.22.4 to 4.6.6 in /samples/vllm/ui #761, chore(deps): bump next from 14.1.1 to 15.5.28 in /samples/vllm/ui #758, chore(deps-dev): bump vite and @vitejs/plugin-vue in /samples/vuejs/app #757 and chore(deps-dev): bump vite, @sveltejs/kit and @sveltejs/vite-plugin-svelte in /samples/sveltekit/sveltekit #756 are major bumps, which the workflow skips by design. So chore(ci): merge all Dependabot updates after CI passes #764'sDEPENDABOT_AUTOMERGE_TOKENis not required for this; I would close it. If you want grouped PRs merged too, the small change is to treat a null update-type like patch/minor. Say if you want that as a PR.Fixed in ci(samples): skip BYOC-only mastra-extended in deploy check #770.
mastra-extendedis not deployable on the Playground (2 GiB model services over the 1 GiB quota, managed Postgres/Redis unsupported).compose updied in about 3s, and the harness's follow-updefang ps --jsonthen exited 5 and hid the cause. ci(samples): skip BYOC-only mastra-extended in deploy check #770 skips it in the deploy check, likeself-improving.Asks for @lionello: