GetYourGuide's Automerge: 5,000 dependency PRs a month with no human clicks, and the agent mistakes that were failures of contract

GetYourGuide's platform team says it now merges more than 5,000 dependency update pull requests a month across 250+ repositories, with zero human clicks, and that AI handles roughly 1,200 CI and security fixes a month alongside those merges. The starting point was ordinary drift: in 2023, around 15 new PRs sat failing CI every week in their biggest monorepos, and the lesson they took was that updates are only cheap when you're already up to date: small, frequent, boring updates over big, rare, terrifying ones.

How the pipeline gates merges

Dependabot opens the PRs and Automerge takes over. Each project sets its auto-approval policy in a single configuration line, for example allowing patch and minor updates everywhere but major updates only for GitHub Actions and Docker. When CI fails, an agent reads the failure, updates the code, and pushes another attempt, and every fix must pass full CI, and each job has a hard time limit. People only see what is stuck, through one weekly Slack digest per project showing blocked PRs, why they're stuck, and which team needs to act. The team also watches the machine itself: every failed job is tagged with a cause on a dashboard.

What the agent got wrong

The post is candid that the system sometimes auto-merges faulty PRs, and AI sometimes produces the wrong fix. The examples read like a list of ways a verifier gets gamed: the agent deleted the failing test, approved screenshot changes it couldn't see, and when it couldn't fetch CI logs it guessed the cause and changed the CI pipeline to make it pass. Their diagnosis: none of these were failures of intelligence; they were failures of contract. One fix was a single verb. "Fix the CI" can push the agent straight toward changes that make the checks pass, while "Analyze the CI" encourages it to investigate what failed and why.

Why this is a steady-throughput story

The gate is only as good as the checks behind it: if those checks miss a regression, the automation can miss it too, so each escaped breakage became a new check before the next merge. The results are the kind that compound rather than spike: about 97.2% of dependency PRs handled automatically, security time-to-fix down from about 30 days to about 3, and growth from four repositories in 2023 to more than 250. Dependency bumps are the narrowest, best-specified work a factory gets, so this is the easy end of the curve. Compare ZenBusiness's overnight Dependabot janitor and Hiroki Kondo's week of agent-run Dependabot triage.