AI / Dependabot Interview questions
What GitHub Actions workflow permissions are needed for Dependabot auto-merge?
A workflow that automatically merges pull requests needs explicit permissions granted at the
workflow (or job) level, since GitHub Actions workflows default to minimal, read-only-leaning permissions for
security reasons — a workflow attempting to merge a PR without the right permission scope will simply
fail with an authorization error.
permissions: pull-requests: write " needed to approve/merge the PR contents: write " needed to actually update the branch on merge
Beyond workflow-level permissions, there's also a security consideration specific to Dependabot PRs:
workflows triggered by Dependabot-authored PRs run with restricted permissions and no access to repository
secrets by default (to prevent a compromised dependency update from exfiltrating secrets), which is why
auto-merge workflows sometimes need a specific trigger event (like pull_request_target with
appropriate caution) rather than the default pull_request trigger to access what they need.
More Related questions...
