Accelerationism

This blog uses a GitHub Action to automatically merge pull requests from dependabot so long as the Netlify deploy preview check succeeds. It was a bit of a pain to get going, and always seemed like a process that GitHub could have made easier.

Of course, that was on purpose:

Sometimes folks ask me why @dependabot doesn't support automerge. It's convenient, and seems like it should just work. So why doesn't it? 1/n

— Justin Hutchings (@jhutchings0) October 31, 2022

While I agree with Justin that researchers are more likely to audit packages than clients and supply chain attacks are worth solving, Accelerate¹ makes a compelling case that it’s better to deploy both good and bad packages faster than stall either in the meantime. Besides, security-sensitive projects already know who they are and have integration processes for auditing dependency updates promptly; automerge is for the rest of us.