Repository navigation
chore(frontend): bump @testing-library/user-event from 14.5.2 to 14.6.3 in /frontend #58
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # OPS-121 — Auto-merge Dependabot patch and minor updates | |
| # | |
| # Strategy: | |
| # • Patch updates (x.y.Z → x.y.Z+1): auto-approved and squash-merged once CI passes. | |
| # • Minor updates (x.Y.z → x.Y+1.z): auto-approved and squash-merged once CI passes. | |
| # • Major updates (X.y.z → X+1.y.z): NOT auto-merged — require human review. | |
| # • GitHub Actions updates: auto-merged regardless of semver level (they use | |
| # immutable SHA or tag pins with no breaking-change risk at the workflow level). | |
| # | |
| # Security: | |
| # • Only runs on PRs opened by the dependabot[bot] actor. | |
| # • Uses the built-in GITHUB_TOKEN with the minimum required permissions. | |
| # • `pull-requests: write` is needed for gh pr review --approve. | |
| # • `contents: write` is needed for gh pr merge. | |
| name: Auto-merge Dependabot PRs | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: | |
| pull-requests: write | |
| contents: write | |
| jobs: | |
| auto-merge: | |
| name: Approve and auto-merge patch/minor updates | |
| runs-on: ubuntu-latest | |
| # Only act on PRs opened by Dependabot | |
| if: github.actor == 'dependabot[bot]' | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v2 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| # ── Patch and minor: approve + queue auto-merge ───────────────────── | |
| - name: Approve patch/minor update | |
| if: > | |
| steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor' | |
| run: gh pr review --approve "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Enable auto-merge for patch/minor update | |
| if: > | |
| steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor' | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # ── GitHub Actions updates: always approve + auto-merge ────────────── | |
| # Actions use tag/SHA pins; version semantics differ from npm/cargo. | |
| - name: Approve GitHub Actions update | |
| if: steps.metadata.outputs.package-ecosystem == 'github-actions' | |
| run: gh pr review --approve "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Enable auto-merge for GitHub Actions update | |
| if: steps.metadata.outputs.package-ecosystem == 'github-actions' | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # ── Major: add a label so humans can triage the review queue ───────── | |
| - name: Label major update for manual review | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-major' | |
| run: gh pr edit "$PR_URL" --add-label "major-update" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |