> I have never seen anyone auto-merge Dependabot PR automatically using GitHub Action. For better or worse, it's a pattern that GitHub explicitly documents[1].

> I have never seen anyone auto-merge Dependabot PR automatically using GitHub Action. For better or worse, it's a pattern that GitHub explicitly documents[1]. (An earlier version of this page also recommended `pull_request_target`, hence the long tail of public repositories that use it.) [1]: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enabling-automerge-on-a-pull-request https://docs.github.com/en/code-security/dependabot/working-...