docs: improve README #111
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependabot Auto-Merge Workflow | |
| # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions | |
| # | |
| # This workflow automatically merges Dependabot PRs for minor and patch version updates | |
| # after all CI checks pass. Major version updates require manual review. | |
| # | |
| # Security: Only PRs from dependabot[bot] are processed. The workflow uses pull_request_target | |
| # to access secrets while still being triggered by Dependabot PRs. | |
| name: Dependabot Auto-Merge | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| runs-on: ubuntu-latest | |
| # Only run for Dependabot PRs - security check to prevent unauthorized auto-merges | |
| if: github.actor == 'dependabot[bot]' | |
| steps: | |
| # Fetch Dependabot metadata to determine update type (major/minor/patch) | |
| - name: Fetch Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v2 | |
| with: | |
| github-token: "${{ secrets.GITHUB_TOKEN }}" | |
| # Log the update type for debugging and audit purposes | |
| - name: Log update type | |
| run: | | |
| echo "Dependabot update type: ${{ steps.metadata.outputs.update-type }}" | |
| echo "Package: ${{ steps.metadata.outputs.dependency-names }}" | |
| echo "New version: ${{ steps.metadata.outputs.new-version }}" | |
| echo "Previous version: ${{ steps.metadata.outputs.previous-version }}" | |
| # Wait for CI checks to complete before attempting merge | |
| # This ensures code quality gates are respected | |
| - name: Wait for CI checks | |
| uses: lewagon/wait-on-check-action@v1.3.4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| # Wait for the main CI workflow to complete | |
| check-name: "test (ubuntu-latest, 20)" | |
| # Allow up to 10 minutes for CI to complete | |
| wait-interval: 30 | |
| allowed-conclusions: success | |
| # Enable auto-merge for minor and patch updates only | |
| # Major updates require manual review due to potential breaking changes | |
| - name: Enable auto-merge for minor/patch updates | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch' | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Log when major updates are skipped (require manual review) | |
| - name: Skip major updates | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-major' | |
| run: | | |
| echo "::notice::Skipping auto-merge for major update. Manual review required." | |
| echo "Package: ${{ steps.metadata.outputs.dependency-names }}" | |
| echo "Update: ${{ steps.metadata.outputs.previous-version }} -> ${{ steps.metadata.outputs.new-version }}" |