Requested by Den Delimarsky · Slack thread

Before / After

Before: every Dependabot PR sits until a core/lead maintainer types /lgtm, even a patch bump to a dev dependency with green CI.

After (opt-in, per consuming repo): Dependabot PRs that pass every check in the policy below get the accepted label, an APPROVE review from mcp-commander, and auto-merge — with no human in the loop. Anything outside the narrow scope (prod deps, major bumps, extra files, human pushes, red or pending CI) is left untouched for a normal /lgtm, with the skip reason written to the action log only.

Security gates (ALL must hold; each fails closed)

1. Real Dependabot — PR author login is dependabot[bot] AND user id is 49699333 (the app's stable id); a lookalike login can never match.
2. Same-repo head — head branch lives in the base repo (never a fork) and starts with dependabot/.
3. Trusted commits — every commit on the PR has a verified signature and is authored by dependabot[bot].
4. File allow-list — changed files are a subset of dependabot-allowed-files (exact paths, default package.json,package-lock.json); renames are checked on both sides.
5. Dependency scope — Dependabot's structured commit metadata (updated-dependencies: block) must show every updated dependency as dependency-type: direct:development with update-type semver-patch or semver-minor. Missing/unparseable metadata never approves. The metadata is trustworthy at this point because gate 3 already proved the commits are dependabot-authored and signed.
6. CI green, enforced in the action — every check run on the head SHA completed with success/neutral/skipped, at least one non-skipped check exists, and the combined commit status (if any statuses exist) is success. This matters because main rulesets require a review but no required status checks — so the approval itself must wait for CI. Pending checks exit silently; the next check_suite completion re-evaluates.
7. PR state — open, not draft, no merge conflicts (mergeable_state !== 'dirty'), and not carrying the do-not-merge/hold label.

Additional hardening:

• Approvals carry a distinct marker (<!-- slash-commands-dependabot-auto -->); the existing push-invalidation now dismisses reviews with either this or the /lgtm marker, so any push dismisses the auto-approval.
• After a human push, gate 3 fails permanently for that PR (a non-dependabot commit is now in its history) — the PR can only proceed via a maintainer's /lgtm. This one-way trapdoor is intentional and documented in the README.
• Unknown mode values disable the feature (fail closed); the mode is off by default (dependabot-auto-approve: '').
• Idempotency guard: concurrent check_suite completions can't stack duplicate approvals.

How

• slash-commands/main.js — new handleDependabotAutoApprove() + parseDependabotMetadata() helpers and a dispatch branch for pull_request_target (opened/reopened) and check_suite (completed, dependabot branches only, with a pulls.list fallback when the suite payload carries no pull_requests). The accept path reuses the existing addLabel/onAccept/enableAutoMerge helpers; dismissBotApprovals now matches both review markers. New result outputs: dependabot-approved, dependabot-skipped.
• slash-commands/action.yml — new inputs dependabot-auto-approve (default '' = disabled) and dependabot-allowed-files (default package.json,package-lock.json), wired through env vars like the existing inputs.
• slash-commands/README.md — new policy section, caller-trigger requirements (pull_request_target: [opened, reopened] + check_suite: [completed]), input/output tables, and a security-notes entry.

Validation

• node --check slash-commands/main.js — clean
• python3 -c "import yaml; yaml.safe_load(open('slash-commands/action.yml'))" — clean (per this repo's CLAUDE.md; there is no test harness in this repo)
• 24 mocked end-to-end scenarios exercised locally against the exported module (happy path on both event types, each gate failing individually, fail-closed on unknown mode, idempotency, invalidation dismissing both markers while sparing human reviews, and /lgtm-path regression) — all passing

Companion wiring PR in the spec repo: modelcontextprotocol/modelcontextprotocol (branch claude/dependabot-auto-approve) — activates there once this merges, since the workflow pins @main.

🤖 Generated with Claude Code

https://claude.ai/code/session_019ygNtiNcAaqTRnQjHCDkVS

Generated by Claude Code