From 1aa1aea57e4bf1a9b588f9f613c8e9cbde927626 Mon Sep 17 00:00:00 2001
From: Maurice <61554723+mauriceboe@users.noreply.github.com>
Date: Thu, 13 Aug 2026 15:39:35 +0200
Subject: [PATCH] ci: retarget Dependabot pull requests onto dev instead of
 labelling them (#1926)

Dependabot cannot be pointed at dev. \	arget-branch\ in dependabot.yml applies to
version updates only, and security updates always open against the default branch.
Security updates are all this repository gets, since there is no dependabot.yml at
all, so every one of them arrives on main.

The branch check then labelled them wrong-base-branch and close-stale-wrong-branch
shut them 24 hours later. Thirteen of the seventeen Dependabot pull requests died
that way; the four that survived were retargeted by hand. The comment the check
leaves asks the author to click Edit, which a bot cannot do.

So retarget them instead. If that fails, because the branch was cut from main and
dev has moved on, it falls through to the existing path so a human sees it rather
than the check quietly passing.

Note this only takes effect once it is on main: pull_request_target loads the
workflow from the pull request's base branch, and these arrive on main.
---
 .github/workflows/enforce-target-branch.yml | 32 +++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/.github/workflows/enforce-target-branch.yml b/.github/workflows/enforce-target-branch.yml
index 36f127d81..2b41b2ec4 100644
--- a/.github/workflows/enforce-target-branch.yml
+++ b/.github/workflows/enforce-target-branch.yml
@@ -68,6 +68,38 @@ jobs:
               return;
             }
 
+            // Dependabot cannot be pointed at dev. `target-branch` in dependabot.yml
+            // applies to version updates only; security updates always open against
+            // the default branch, and security updates are all this repository gets
+            // (there is no dependabot.yml). Labelling them meant close-stale-wrong-branch
+            // shut them 24 hours later, which is how 13 of them died. Retarget instead:
+            // a bot cannot click "Edit" the way the comment below asks a human to.
+            if (context.payload.pull_request.user.login === 'dependabot[bot]') {
+              try {
+                await github.rest.pulls.update({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  pull_number: prNumber,
+                  base: 'dev',
+                });
+                if (labels.includes('wrong-base-branch')) {
+                  await github.rest.issues.removeLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: prNumber,
+                    name: 'wrong-base-branch',
+                  });
+                }
+                console.log('Retargeted the Dependabot PR onto dev.');
+                return;
+              } catch (err) {
+                // Retargeting can fail when the branch was cut from main and dev has
+                // moved on. Fall through to the normal path so a human sees it rather
+                // than the check passing on a PR that is still aimed at main.
+                console.log(`Could not retarget the Dependabot PR: ${err.message}`);
+              }
+            }
+
             // Base is main — check if this user is a maintainer
             let permission = 'none';
             try {