From 85471e7a006c1a54ee3e545c57e2072bb89ca12d Mon Sep 17 00:00:00 2001
From: Timothee Guerin <tiguerin@microsoft.com>
Date: Mon, 5 Oct 2026 08:16:13 -0400
Subject: [PATCH 1/2] ci: auto-merge Dependabot updates

---
 .github/policies/pr.dependabot-auto-merge.yml | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/policies/pr.dependabot-auto-merge.yml

diff --git a/.github/policies/pr.dependabot-auto-merge.yml b/.github/policies/pr.dependabot-auto-merge.yml
new file mode 100644
index 0000000..2562980
--- /dev/null
+++ b/.github/policies/pr.dependabot-auto-merge.yml
@@ -0,0 +1,37 @@
+id: pr.dependabot-auto-merge
+name: GitOps.PullRequestIssueManagement
+description: Automatically approve and merge Dependabot updates
+owner:
+resource: repository
+disabled: false
+where:
+configuration:
+  resourceManagementConfiguration:
+    eventResponderTasks:
+      - description: Approve and auto-merge Dependabot updates
+        if:
+          - payloadType: Pull_Request
+          - hasLabel:
+              label: dependencies
+          - targetsBranch:
+              branch: main
+          - isActivitySender:
+              user: dependabot[bot]
+              issueAuthor: true
+        then:
+          - approvePullRequest:
+              comment: 'Approved automatically for a Dependabot update.'
+          - addLabel:
+              label: auto-merge
+          - enableAutoMerge:
+              mergeMethod: Squash
+
+      - description: Disable auto-merge when the auto-merge label is removed
+        if:
+          - payloadType: Pull_Request
+          - labelRemoved:
+              label: auto-merge
+        then:
+          - disableAutoMerge
+onFailure:
+onSuccess:

From 54301acfe8e89144a96e884e8497fd6726ca1a61 Mon Sep 17 00:00:00 2001
From: Timothee Guerin <tiguerin@microsoft.com>
Date: Mon, 5 Oct 2026 10:16:04 -0400
Subject: [PATCH 2/2] fix: approve Dependabot updates once

---
 .github/policies/pr.dependabot-auto-merge.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/policies/pr.dependabot-auto-merge.yml b/.github/policies/pr.dependabot-auto-merge.yml
index 2562980..13b47f3 100644
--- a/.github/policies/pr.dependabot-auto-merge.yml
+++ b/.github/policies/pr.dependabot-auto-merge.yml
@@ -11,6 +11,8 @@ configuration:
       - description: Approve and auto-merge Dependabot updates
         if:
           - payloadType: Pull_Request
+          - isAction:
+              action: Opened
           - hasLabel:
               label: dependencies
           - targetsBranch: