Skip to content

[bot] Bump hoverinc/action-pr-automation/.github/workflows/pr-automation.yml from 1.1.0 to 1.5.0 - #37

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/hoverinc/action-pr-automation/dot-github/workflows/pr-automation.yml-1.5.0
Open

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/github_actions/hoverinc/action-pr-automation/dot-github/workflows/pr-automation.yml-1.5.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 16, 2026 •

Copy link
Copy Markdown

Bumps hoverinc/action-pr-automation/.github/workflows/pr-automation.yml from 1.1.0 to 1.5.0.

Release notes

Sourced from hoverinc/action-pr-automation/.github/workflows/pr-automation.yml's releases.

v1.5.0

New Feature

Callers can opt into an advisory Claude risk comment on dependabot PRs with dependabot-analysis: true, instead of each repo maintaining its own copy of the analyzer. The comment is advisory: a separate job approves and may auto-merge the PR regardless of what the analysis finds, and a skipped, failed, or timed-out analysis never holds up the approve path. What Claude can do is bounded by the tool allowlist, so a PR comment is the only thing it can produce.

Callers that don't set dependabot-analysis: true keep the behavior they have today.

Adopting

Three things in the calling repo:

  1. Add dependabot-analysis: true to the existing with: block.
  2. Add an ANTHROPIC_DEPENDABOT_ANALYSIS secret.
  3. Add issues: read, actions: read, and id-token: write to the caller's own permissions: block. A called workflow can only narrow what the caller grants, so without these the analysis fails at auth and posts nothing.

Optional inputs: dependabot-analysis-prompt for repo-specific context, dependabot-analysis-events (default opened,reopened), dependabot-analysis-model, and dependabot-analysis-budget-usd (default 5.00).

One thing to watch on the bump: the new permission scopes are declared on the shared workflow, and it isn't yet confirmed whether GitHub validates them before skipping the opted-out job. If a caller that hasn't opted in hits a permissions error on its next dependabot PR, adding the three scopes above clears it, and a patch release will follow.

What's Changed

Full Changelog: https://github.com/hoverinc/action-pr-automation/compare/v1.4.1...v1.5.0

v1.4.1

What's Changed

deps

Full Changelog: https://github.com/hoverinc/action-pr-automation/compare/v1.4.0...v1.4.1

v1.4.0

What's Changed

Full Changelog: https://github.com/hoverinc/action-pr-automation/compare/v1.3.0...v1.4.0

v1.3.0

New Feature

Add auto-merge-patch input to auto-merge patch dependency updates

... (truncated)

Commits
  • 1cead31 [ROO-1072] Add advisory dependabot risk analysis as a shared reusable workflo...
  • f490fac [bot] Bump the codeql group with 2 updates (#66)
  • a50d3d3 [bot] Bump the codeql group with 2 updates (#65)
  • d4dcf98 [bot] Bump the codeql group with 2 updates (#64)
  • dc6c12e [bot] Bump the codeql group with 2 updates (#63)
  • a0df467 [ROO-836] - Update bot user for translation sync automation (#62)
  • 7f2a040 [bot] Bump the codeql group with 2 updates (#61)
  • 6f06342 [ROO-837] - Support grouped dependency updates with comma-separated names (#60)
  • fbc37fe [ROO-837] Add auto-merge-patch input to auto-merge patch dependency updates (...
  • 74f3c38 [bot] Bump actions/setup-go from 6.5.0 to 7.0.0 (#58)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

…ion.yml

Bumps [hoverinc/action-pr-automation/.github/workflows/pr-automation.yml](https://github.com/hoverinc/action-pr-automation) from 1.1.0 to 1.5.0.
- [Release notes](https://github.com/hoverinc/action-pr-automation/releases)
- [Commits](hoverinc/action-pr-automation@763fe36...1cead31)

---
updated-dependencies:
- dependency-name: hoverinc/action-pr-automation/.github/workflows/pr-automation.yml
  dependency-version: 1.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants