A GitHub Action that automerges maintenance bot PRs safely

I built a small GitHub Action for automerging maintenance bot PRs from Dependabot, Snyk, Renovate, etc.

The goal is to stop manually merging routine dependency and maintenance PRs, while still avoiding unsafe merges.

What it does:

• Runs only for PR-related events.
• Only handles PRs from configured bot accounts.
• Waits for other checks to finish before merging.
• Syncs the PR branch with the target branch when it is behind.
• Merges only when checks pass and GitHub reports the PR as mergeable.
• Comments @dependabot rebase when Dependabot needs a rebase.
• Mentions configured maintainers when checks fail, merge conflicts happen, or GitHub refuses the merge.
• Suppresses duplicate comments.
• Adds a small pre-merge explanation comment so the PR timeline is less scary.

It is written in Go and packaged as a Docker GitHub Action.

Repo: https://github.com/oleg-koval/pr-automerge-github-action

🧺️ Marketplace

Example workflow:

 name: Bot automerge

 on:
   pull_request_target:
     types: [opened, reopened, synchronize, ready_for_review, edited]
   check_suite:
     types: [completed]
   pull_request_review:
     types: [submitted]

 permissions:
   contents: write
   pull-requests: write
   checks: read
   statuses: read
   issues: write

 jobs:
   automerge:
     runs-on: ubuntu-latest
     steps:
       - uses: oleg-koval/pr-automerge-github-action@v1
         with:
           github-token: ${{ github.token }}
           maintainer-handles: oleg-koval
           merge-method: squash
           wait-timeout: 30m

I made it mostly because my public repos were accumulating low-risk dependency PRs, but I still wanted failed/breaking updates to notify me instead of silently merging.