4 ms·

There are projects that automatically merge dependabot PRs...

• mistrial9 3y ago
  projects with underpaid and outsourced contractors by any chance?
  • MiguelX413 3y ago
    More likely, simply open-source projects.
• earthling8118 3y ago
  Funnily enough I'd assume that those projects would be immune to this type of attack unless the automation is absolutely terrible.
• oalders 3y ago
  Presumably an automated merge would be checking something like > if: github.event.pull_request.user.login == 'dependabot[bot]'
  • turboponyy 3y ago
    No, the automated workflow would be something like this: - Run dependabot workflow (outputs: $pr_number) - Automerge $pr_number