From b29688612b4bf5014eba7b986e749d7f8ef61dfe Mon Sep 17 00:00:00 2001
From: arzafran <franco@darkroom.engineering>
Date: Thu, 5 Nov 2026 18:48:45 -0300
Subject: [PATCH 1/2] fix(dependabot-merge): approve the PR before merging so
 the review ruleset allows it

---
 .github/workflows/dependabot-merge.yml | 11 ++++++++++-
 README.md                              |  7 +++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml
index 9d23c49..7e36b98 100644
--- a/.github/workflows/dependabot-merge.yml
+++ b/.github/workflows/dependabot-merge.yml
@@ -185,7 +185,7 @@ jobs:
           echo "$PACKAGE $VERSION is $age days old."
           echo "old_enough=true" >> "$GITHUB_OUTPUT"
 
-      - name: Verify latest CI run and squash merge
+      - name: Verify latest CI run, approve and squash merge
         if: >
           steps.pr.outputs.number != '' &&
           steps.update_type.outputs.skip == 'false' &&
@@ -212,5 +212,14 @@ jobs:
             echo "CI was superseded, rerun or is not successful; not auto-merging."
             exit 0
           fi
+          # The org's "Review required" ruleset wants one approval, and
+          # without it the merge below is refused. The approval is pinned to
+          # the commit CI just passed, so a later push is never approved.
+          # Needs "Allow GitHub Actions to create and approve pull requests"
+          # in the repo's Actions settings.
+          gh api "/repos/$REPO/pulls/$PR/reviews" \
+            -f commit_id="$HEAD_SHA" -f event=APPROVE \
+            -f body='Stable patch or minor update, CI passed, release old enough.' \
+            > /dev/null
           gh pr merge "$PR" --repo "$REPO" --squash --delete-branch \
             --match-head-commit "$HEAD_SHA"
diff --git a/README.md b/README.md
index e86bfd8..a0dbf27 100644
--- a/README.md
+++ b/README.md
@@ -83,8 +83,11 @@ Major, 0.x, prerelease, grouped and unrecognized titles remain manual. The workf
 requires a unique open, nondraft Dependabot PR from the same repository to `main`,
 the exact current head, and a successful latest run and attempt of the triggering
 CI workflow. Actions-only changes require the complete paginated file list,
-including previous paths for renames. Merge uses `--match-head-commit` without
-an administrative bypass.
+including previous paths for renames. The workflow then approves the PR at the
+head CI passed, which the org's "Review required" ruleset needs, and merges with
+`--match-head-commit` without an administrative bypass. The approval needs
+"Allow GitHub Actions to create and approve pull requests" on in the caller
+repository's Actions settings; without it, the workflow fails at the approval.
 
 Two more guards apply to every caller:
 

From 272b46c04b0cc9039222be4480d74aba4a9da73b Mon Sep 17 00:00:00 2001
From: arzafran <franco@darkroom.engineering>
Date: Thu, 5 Nov 2026 18:51:49 -0300
Subject: [PATCH 2/2] fix(dependabot-merge): withdraw the approval when the
 merge fails

---
 .github/workflows/dependabot-merge.yml | 17 ++++++++++++-----
 README.md                              |  4 +++-
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml
index 7e36b98..9b7ed3c 100644
--- a/.github/workflows/dependabot-merge.yml
+++ b/.github/workflows/dependabot-merge.yml
@@ -214,12 +214,19 @@ jobs:
           fi
           # The org's "Review required" ruleset wants one approval, and
           # without it the merge below is refused. The approval is pinned to
-          # the commit CI just passed, so a later push is never approved.
+          # the commit CI just passed. The ruleset does not dismiss stale
+          # approvals on push, so a failed merge dismisses it: left in place,
+          # it would let a later push merge without a human review.
           # Needs "Allow GitHub Actions to create and approve pull requests"
           # in the repo's Actions settings.
-          gh api "/repos/$REPO/pulls/$PR/reviews" \
+          review_id=$(gh api "/repos/$REPO/pulls/$PR/reviews" \
             -f commit_id="$HEAD_SHA" -f event=APPROVE \
             -f body='Stable patch or minor update, CI passed, release old enough.' \
-            > /dev/null
-          gh pr merge "$PR" --repo "$REPO" --squash --delete-branch \
-            --match-head-commit "$HEAD_SHA"
+            --jq .id)
+          if ! gh pr merge "$PR" --repo "$REPO" --squash --delete-branch \
+            --match-head-commit "$HEAD_SHA"; then
+            gh api -X PUT "/repos/$REPO/pulls/$PR/reviews/$review_id/dismissals" \
+              -f message='Auto-merge failed; approval withdrawn.' > /dev/null || \
+              echo "::error::Merge failed and the approval could not be dismissed. Dismiss review $review_id on #$PR by hand."
+            exit 1
+          fi
diff --git a/README.md b/README.md
index a0dbf27..7fee9ef 100644
--- a/README.md
+++ b/README.md
@@ -85,7 +85,9 @@ the exact current head, and a successful latest run and attempt of the triggerin
 CI workflow. Actions-only changes require the complete paginated file list,
 including previous paths for renames. The workflow then approves the PR at the
 head CI passed, which the org's "Review required" ruleset needs, and merges with
-`--match-head-commit` without an administrative bypass. The approval needs
+`--match-head-commit` without an administrative bypass. If the merge fails, the
+workflow dismisses its approval, because the ruleset keeps approvals after a
+push. The approval needs
 "Allow GitHub Actions to create and approve pull requests" on in the caller
 repository's Actions settings; without it, the workflow fails at the approval.