Preferably keep a separate branch in your repo that mirrors the Trellis master branch then merge from your Trellis mirror branch to your working config. This way your not pulling and merging directly to your working branch.
Maybe there is a better way but it’s always been solid for me.
In case this is helpful to other readers, I typically don’t customize Trellis very heavily, so my update process is often as easy as backing up /group_vars, /hosts, and /deploy_hooks, cloning Trellis fresh from GitHub, and copying relevant settings into the new clone.