From cb94382ffb8202edbece1f07f1b24553a61b1700 Mon Sep 17 00:00:00 2001
From: nicktrn <55853254+nicktrn@users.noreply.github.com>
Date: Fri, 1 May 2026 15:30:11 +0100
Subject: [PATCH] ci: vouch dependabot[bot] (#3496)

Dependabot's first auto-bump PR (#3495) was auto-closed because
`dependabot[bot]` isn't in the vouch list and isn't exempt from the
require-draft check.

Two changes:

- Add `dependabot[bot]` to `.github/VOUCHED.td` so the vouch check
passes.
- Add `dependabot[bot]` to the require-draft exception in
`vouch-check-pr.yml` (alongside `devin-ai-integration[bot]`) so its PRs
aren't closed for being non-draft.

Without both, dependabot bumps will keep getting closed and we lose the
weekly action update flow that #3494 set up.
---
 .github/VOUCHED.td                   | 1 +
 .github/workflows/vouch-check-pr.yml | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/VOUCHED.td b/.github/VOUCHED.td
index f9f312263..a257444ca 100644
--- a/.github/VOUCHED.td
+++ b/.github/VOUCHED.td
@@ -13,6 +13,7 @@ samejr
 isshaddad
 # Bots
 devin-ai-integration[bot]
+dependabot[bot]
 # Outside contributors
 gautamsi
 capaj
diff --git a/.github/workflows/vouch-check-pr.yml b/.github/workflows/vouch-check-pr.yml
index 2109b7d32..ab2827555 100644
--- a/.github/workflows/vouch-check-pr.yml
+++ b/.github/workflows/vouch-check-pr.yml
@@ -28,7 +28,8 @@ jobs:
       github.event.pull_request.author_association != 'MEMBER' &&
       github.event.pull_request.author_association != 'OWNER' &&
       github.event.pull_request.author_association != 'COLLABORATOR' &&
-      github.event.pull_request.user.login != 'devin-ai-integration[bot]'
+      github.event.pull_request.user.login != 'devin-ai-integration[bot]' &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
       - name: Close non-draft PR