Merge pull request #206 from GizzZmo/chore/dependabot-metadata-labels

chore(ci): configure Dependabot metadata labels

Author: GizzZmo

.github/WORKFLOWS.md

@@ -200,7 +200,7 @@ All workflows have been enhanced with:
 
 - Automatic PR creation for updates
 - Weekly schedule to minimize noise
-- Labels: `dependencies`, `automated`
+- Labels: `dependencies`, `npm` / `github-actions`, `automated`
 - Auto-reviewers assigned
 - **Grouped updates** (noise reduction):
   - `production-dependencies` — minor/patch production deps
@@ -217,16 +217,26 @@ All workflows have been enhanced with:
 
 **Triggers:** Pull Request events from Dependabot
 
-**Purpose:** Automatically merge safe dependency updates
+**Purpose:** Automatically merge safe dependency updates and apply metadata labels
 
 **Jobs:**
 
 - **Auto-merge**:
-  - ✅ Fetch Dependabot metadata
+  - ✅ Fetch Dependabot metadata (`dependabot/fetch-metadata@v2`)
+  - ✅ **Ensure metadata labels exist** (`semver-major`, `semver-minor`, `semver-patch`, `production`, `development`, `npm`, `github-actions`)
+  - ✅ **Apply metadata labels** based on update-type, dependency-type, and package-ecosystem
   - ✅ Check update type (major/minor/patch)
   - ✅ Auto-approve minor and patch updates
   - ✅ Enable auto-merge for safe updates
-  - ✅ Comment on major updates requiring manual review
+  - ✅ Comment on major updates requiring manual review (with `semver-major` label)
+
+**Metadata labels applied:**
+
+| Label | Source |
+|-------|--------|
+| `semver-major` / `semver-minor` / `semver-patch` | `update-type` |
+| `production` / `development` | `dependency-type` |
+| `npm` / `github-actions` | `package-ecosystem` |
 
 **Safety:** Only auto-merges minor and patch updates
 

.github/dependabot.yml

@@ -12,6 +12,7 @@ updates:
       - 'GizzZmo'
     labels:
       - 'dependencies'
+      - 'npm'
       - 'automated'
     commit-message:
       prefix: 'chore(deps):'

.github/workflows/auto-merge-dependabot.yml

@@ -7,6 +7,7 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  issues: write
 
 jobs:
   auto-merge:
@@ -21,6 +22,64 @@ jobs:
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
 
+      - name: Ensure metadata labels exist
+        run: |
+          # Create SemVer + dependency-type labels if missing (idempotent)
+          declare -A LABELS=(
+            ["semver-major"]="Major version bump — requires manual review"
+            ["semver-minor"]="Minor version bump"
+            ["semver-patch"]="Patch version bump"
+            ["production"]="Production / runtime dependency"
+            ["development"]="Development / tooling dependency"
+            ["npm"]="npm package ecosystem"
+            ["github-actions"]="GitHub Actions ecosystem"
+          )
+          for name in "${!LABELS[@]}"; do
+            gh label create "$name" \
+              --description "${LABELS[$name]}" \
+              --color "0366d6" \
+              --force 2>/dev/null || true
+          done
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Apply Dependabot metadata labels
+        run: |
+          PR_URL="${{ github.event.pull_request.html_url }}"
+          LABELS=()
+
+          # SemVer labels from update-type
+          case "${{ steps.metadata.outputs.update-type }}" in
+            version-update:semver-major) LABELS+=("semver-major") ;;
+            version-update:semver-minor) LABELS+=("semver-minor") ;;
+            version-update:semver-patch) LABELS+=("semver-patch") ;;
+          esac
+
+          # Dependency type (direct:production / direct:development / indirect)
+          DEP_TYPE="${{ steps.metadata.outputs.dependency-type }}"
+          if [[ "$DEP_TYPE" == *"production"* ]]; then
+            LABELS+=("production")
+          elif [[ "$DEP_TYPE" == *"development"* ]]; then
+            LABELS+=("development")
+          fi
+
+          # Package ecosystem
+          case "${{ steps.metadata.outputs.package-ecosystem }}" in
+            npm)            LABELS+=("npm") ;;
+            github_actions) LABELS+=("github-actions") ;;
+          esac
+
+          # Apply any collected labels
+          if [ ${#LABELS[@]} -gt 0 ]; then
+            LABEL_ARGS=$(printf -- '--add-label %s ' "${LABELS[@]}")
+            gh pr edit "$PR_URL" $LABEL_ARGS
+            echo "Applied labels: ${LABELS[*]}"
+          else
+            echo "No additional metadata labels to apply"
+          fi
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Check if safe to auto-merge
         id: check_safe
         run: |
@@ -55,5 +114,5 @@ jobs:
               issue_number: context.issue.number,
               owner: context.repo.owner,
               repo: context.repo.repo,
-              body: '⚠️ **Major version update detected!** Please review this PR manually before merging.'
+              body: '⚠️ **Major version update detected!** Please review this PR manually before merging.\n\nLabel `semver-major` has been applied for triage.'
             })