Works with · Dependabot · Renovate

Do Dependabot and Renovate PRs need a human approval for SOC 2?

Yes, if they merge to production. A dependency bump is a production change, and auditors sample those too. Dependabot and Renovate open the PRs; PSCO gives each one a named human decision at the Attest tier, priced at half a unit, so bot PRs stay fast and still have an approver on the record.

How Dependabot · Renovate reviews

Dependabot and Renovate open pull requests that bump dependencies, with changelogs and compatibility signals. They do not review code.

What it cannot do

A bot-authored PR with no human approval is the clearest case of a missing approver an auditor can find. Auto-merging dependency bumps without a non-author approval is an audit finding waiting to happen.

How PSCO reads its output

PSCO recognizes the bot authors, tiers the PR as Attest when your model sets bot_authors_attest: true, and the Officer confirms the bump is a dependency-only change against your license allowlist before approving. Attest-tier work takes about a minute.

Recognized asbot logins

dependabot[bot]Bot PRs (Attest tier when the model allows)

renovate[bot]

Two-step setup

Keep Dependabot · Renovate.

Keep Dependabot or Renovate on; set bot_prs: attest in your model.

Add PSCO.

Install the PSCO GitHub App, select the repos in scope, and require psco/approved and one approval from @psco-officers; key auto-merge to the check.

The shared-model tip

Point it at the same model the Officer uses.

Set dependencies.license_allowlist and dependencies.bot_prs in psco.model.yaml; configure Renovate or Dependabot to group updates the same way so each bot PR maps to one Attest decision.

psco.model.yamlv1 · customer-owned

frameworks: [soc2, iso27001]
sensitive_paths:
  auth/**: deep
  infra/**: deep
required_checks: [ci, tests, sast, secrets]
forbidden: [hardcoded_secret, tls_verify_off]

Other reviewers

Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · All

Keep Dependabot · Renovate. Add the human who signs.

Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.

Get a quote in 2 minutes Book a meeting