deps(deps): bump the npm-minor-patch group across 1 directory with 31 updates #879
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # Auto-approve + auto-merge Dependabot PRs that match high-trust criteria | |
| # (patch + minor version bumps for security-relevant ecosystems). Major | |
| # version bumps are NOT auto-merged: they get a Dependabot PR but require | |
| # manual review because semantic version theory holds that majors may break. | |
| # | |
| # Why this exists: per the operator's policy, security-patch PRs for | |
| # transitive deps should land continuously without per-PR review friction. | |
| # Manual review for these turns Dependabot into a backlog instead of a | |
| # safety net. The 10 required CI checks on `main` (test, scan / gitleaks, | |
| # scan / TruffleHog, scan / typos, pre-commit textleaks+oss-twin-check, | |
| # CodeQL, Analyze actions, Analyze javascript-typescript, Analyze python, | |
| # Analyze rust) already gate the merge; auto-merge just removes the human | |
| # in the loop for low-risk version bumps that pass those gates. | |
| # | |
| # Configuration: | |
| # - Only PRs authored by dependabot[bot] are considered | |
| # - Approval + auto-merge enabled for patch/minor updates | |
| # - Major updates labeled "major" by Dependabot get NO auto-action; | |
| # require manual review | |
| # | |
| # Source: GitHub's official Dependabot auto-merge guide. | |
| # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions | |
| on: pull_request | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| dependabot: | |
| runs-on: ubuntu-latest | |
| if: github.actor == 'dependabot[bot]' | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: meta | |
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 | |
| with: | |
| github-token: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Auto-approve + enable auto-merge (patch + minor only) | |
| if: steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor' | |
| run: | | |
| gh pr review --approve "$PR_URL" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |