[lucaghersi]

Type of Change

• Bugfix
• Enhancement / new feature
• Refactoring
• Documentation

Description

Goal: auto-merge Dependabot updates that change only a Docker image digest, such as Chainguard rebuilds pinned as tag@sha256:.... Dependabot gives them no semver update type, so the template skipped them.

What changed: a new input, allow-digest-updates, default true (opt out with false). For a Docker update without an update type, a new step removes every @sha256: digest from the PR diff. The PR merges only if the changed lines are then identical. A non-numeric tag change (bookworm-20250908 to bookworm-20250929) has the same empty metadata, but fails this check.

How to review: tested against custom-images #565 #567 #568 #590 #593 (detected), #582 #314 #594 (rejected), and a stubbed bookworm tag change (rejected).

Checklist

• Add relevant labels (for example type of change or patch/minor/major)
• Make sure not to introduce some mistakes
• Update documentation
• Review the Contributing Guideline and sign CLA
• Reference relevant issue(s) and close them after merging

🤖 Generated with Claude Code

[coderabbitai]

🟡 Needs attention — Enabling the new opt-in allows qualifying Docker digest updates to merge, which changes merge behavior.
The change lets repositories accept digest-only Docker updates without changing their image tags.

Walkthrough

The Dependabot auto-merge workflow adds an optional allow-digest-updates input, defaulting to false. When enabled, the workflow permits Docker updates with an empty update type and previous version if the new version is nonempty. Existing SemVer and prerelease checks remain. The README example enables digest updates.

Suggested reviewers: 0x46616c6b

Merge Risk: Moderate · previous review 5d62c

With allow-digest-updates enabled, Docker tag bumps with non-semver tags may be auto-merged as if they were digest-only updates. Tighten the digest-only detection before enabling this broadly; repositories that leave the input off are unaffected.

Architecture risk: Low · up to 5d62c

The change affects 1 system.

Changed systems: README.md

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — README.md (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in README.md: The Auto-Merge Dependabot example adds allow-digest-updates: true, with a comment describing digest-only Docker updates that retain their tag.
• observed — Modified behavior in .github/workflows/template_automerge_dependabot.yml: Adds the optional allow-digest-updates boolean workflow input, defaulting to false.
• observed — Modified behavior in .github/workflows/template_automerge_dependabot.yml: Keeps the existing SemVer update-type checks and prerelease rule, and adds an alternative path that permits merging when digest updates are enabled, the package ecosystem starts with docker, the update type and previous version are empty, and the new version is nonempty.

Pre-merge checks: 1

Check name	Status	Explanation
Title check		The title follows the Conventional Commits format with the scope set to automerge. It names the main change: an opt-in input that lets digest-only Docker updates merge. The title does not use a ticket…

Full details: Title check

Explanation

The title follows the Conventional Commits format with the scope set to automerge. It names the main change: an opt-in input that lets digest-only Docker updates merge. The title does not use a ticket key, which the title requirements allow for untracked work.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[coderabbitai]

• Fix comments: Fix CodeRabbit comments on this PR