From 56ffbda9776a2a39113705919df833dfc1e922b1 Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Thu, 8 Oct 2026 09:49:05 -0400
Subject: [PATCH 1/2] DEVOPS-1218: allow auto-merge of major pre-commit-hooks
 Dependabot updates

---
 .../reusable-dependabot-auto-merge.yml        | 28 ++++++++++++++-----
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/reusable-dependabot-auto-merge.yml b/.github/workflows/reusable-dependabot-auto-merge.yml
index 34cbb3dd..3ddcd83a 100644
--- a/.github/workflows/reusable-dependabot-auto-merge.yml
+++ b/.github/workflows/reusable-dependabot-auto-merge.yml
@@ -33,6 +33,7 @@ jobs:
     timeout-minutes: 5
     outputs:
       is_allowed_group: ${{ steps.check.outputs.is_allowed_group }}
+      group: ${{ steps.check.outputs.group }}
     steps:
       - name: Check Dependabot group
         id: check
@@ -44,15 +45,18 @@ jobs:
           # e.g. "dependabot/pre_commit/main/pre-commit-hooks-251825f045".
           branch_suffix="${HEAD_REF##*/}"
           allowed=false
+          matched_group=''
           IFS=',' read -ra groups <<< "$GROUPS"
           for group in "${groups[@]}"; do
             group=$(echo "$group" | xargs)
             if [ -n "$group" ] && [[ "$branch_suffix" =~ ^${group}-[0-9a-f]+$ ]]; then
               allowed=true
+              matched_group="$group"
               break
             fi
           done
           echo "is_allowed_group=$allowed" >> "$GITHUB_OUTPUT"
+          echo "group=$matched_group" >> "$GITHUB_OUTPUT"
 
   auto-merge:
     needs: validate-group
@@ -67,6 +71,21 @@ jobs:
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
 
+    - name: Decide whether to auto-merge
+      id: policy
+      env:
+        UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
+        GROUP: ${{ needs.validate-group.outputs.group }}
+      run: |
+        # Majors only for pre-commit-hooks: the PR's own pre-commit run validates the new hook versions.
+        should_merge=false
+        case "$UPDATE_TYPE" in
+          version-update:semver-patch|version-update:semver-minor) should_merge=true ;;
+          version-update:semver-major) [ "$GROUP" = "pre-commit-hooks" ] && should_merge=true ;;
+        esac
+        echo "Update type: ${UPDATE_TYPE:-unknown}, group: $GROUP, auto-merge: $should_merge"
+        echo "should_merge=$should_merge" >> "$GITHUB_OUTPUT"
+
     - name: Validate checks-to-skip are not GitHub Actions checks
       if: inputs.checks-to-skip != ''
       env:
@@ -91,10 +110,7 @@ jobs:
         done
 
     - name: Mark skipped external checks as passed
-      if: >
-        inputs.checks-to-skip != '' &&
-        (steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-         steps.metadata.outputs.update-type == 'version-update:semver-minor')
+      if: inputs.checks-to-skip != '' && steps.policy.outputs.should_merge == 'true'
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         CHECKS_TO_SKIP: ${{ inputs.checks-to-skip }}
@@ -117,9 +133,7 @@ jobs:
         done
 
     - name: Approve and enable auto-merge
-      if: >
-        steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-        steps.metadata.outputs.update-type == 'version-update:semver-minor'
+      if: steps.policy.outputs.should_merge == 'true'
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         PR_URL: ${{ github.event.pull_request.html_url }}

From b43f43b2a51700b9d8173195c264778773982027 Mon Sep 17 00:00:00 2001
From: Romain Floreani <romainf@mirageoscience.com>
Date: Tue, 13 Oct 2026 16:11:44 -0400
Subject: [PATCH 2/2] Update
 .github/workflows/reusable-dependabot-auto-merge.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Sébastien Hensgen <24550538+sebhmg@users.noreply.github.com>
---
 .github/workflows/reusable-dependabot-auto-merge.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/reusable-dependabot-auto-merge.yml b/.github/workflows/reusable-dependabot-auto-merge.yml
index 3ddcd83a..88d14116 100644
--- a/.github/workflows/reusable-dependabot-auto-merge.yml
+++ b/.github/workflows/reusable-dependabot-auto-merge.yml
@@ -77,7 +77,8 @@ jobs:
         UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
         GROUP: ${{ needs.validate-group.outputs.group }}
       run: |
-        # Majors only for pre-commit-hooks: the PR's own pre-commit run validates the new hook versions.
+        # Allow major version bumps for pre-commit hooks only:
+        # the PR's pre-commit run validates the updated hook versions.
         should_merge=false
         case "$UPDATE_TYPE" in
           version-update:semver-patch|version-update:semver-minor) should_merge=true ;;