[dprotaso]

Automatically apply skip-review to Dependabot pull requests so Prow can merge eligible updates once required checks and other merge conditions pass.

Proposed Changes

• Add a repository-owned workflow for opened, reopened, or synchronized PRs authored by dependabot[bot].
• Cover every Dependabot ecosystem, including Rust and future additions, without changing dependency update schedules, grouping, or security-update settings.
• Use pull_request_target with only pull-requests: write. Do not check out or execute PR code; the only operation adds the label through the GitHub API.

The PR changes only .github/workflows/dependabot-labels.yaml. Dependabot's existing configuration remains unchanged. The workflow does not approve or merge PRs itself and becomes active once merged into the base branch.

The 29 open Dependabot PRs were already labeled directly as a one-time backfill.

Validation

• Parsed workflow YAML and checked event types, the bot-author condition, and minimal permissions.
• Confirmed no PR code checkout or action execution.
• Validated embedded shell syntax with bash -n.
• git diff --check.

[netlify]

✅ Deploy Preview for knative ready!

Name	Link
🔨 Latest commit	f2d2503
🔍 Latest deploy log	https://app.netlify.com/projects/knative/deploys/6adace23eedb7d702371497f
😎 Deploy Preview	https://deploy-preview-6723--knative.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[dprotaso]

/assign @dsimansk

[dprotaso]

/assign @evankanderson

[evankanderson]

Do we have to worry about other users adding commits to a dependabot branch?

[dprotaso]

Do we have to worry about other users adding commits to a dependabot branch?

I don't think so you would need write access to the repo because that's where the branch is made.

[dprotaso]

Do we have to worry about other users adding commits to a dependabot branch?

Also FYI - us maintainers have generally also pushed commits to say knative-automation dependency bump branches to unblock PRs - eg. new go version that is triggering new linting errors etc.

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dprotaso, evankanderson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dprotaso,evankanderson]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[dprotaso]

/hold

I don't want to merge changes while updating code samples