What GitHub Actions workflow permissions are needed for Dependabot auto-merge?

A workflow that automatically merges pull requests needs explicit permissions granted at the workflow (or job) level, since GitHub Actions workflows default to minimal, read-only-leaning permissions for security reasons — a workflow attempting to merge a PR without the right permission scope will simply fail with an authorization error.

permissions:
  pull-requests: write   "  needed to approve/merge the PR
  contents: write        "  needed to actually update the branch on merge

Beyond workflow-level permissions, there's also a security consideration specific to Dependabot PRs: workflows triggered by Dependabot-authored PRs run with restricted permissions and no access to repository secrets by default (to prevent a compromised dependency update from exfiltrating secrets), which is why auto-merge workflows sometimes need a specific trigger event (like pull_request_target with appropriate caution) rather than the default pull_request trigger to access what they need.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.