Repository navigation
chore(deps-dev): bump the development-minor-patch group with 4 updates #1254
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # Auto-enables GitHub's native auto-merge on Dependabot PRs that match | |
| # our safety bands, so they merge themselves once CI passes. CI is the | |
| # real safety net here: every auto-merge still has to pass Lint & Build | |
| # and Validate SVG. The classification below is just about which bumps | |
| # we never want a human to gate on. | |
| # | |
| # Auto-merged: | |
| # - Any patch update (runtime or dev) | |
| # - Any minor update (runtime or dev) — CI catches the rest | |
| # - Any update on a dev-only dependency, including majors (we'll catch | |
| # real breakage in Lint & Build before it can hit anyone) | |
| # - Any GitHub Actions bump | |
| # | |
| # Labeled needs-review (human merges): | |
| # - Production major bumps only — the one class that warrants reading | |
| # the release notes before shipping | |
| # | |
| # This tier matters for autonomous-mode: nobody should need to babysit | |
| # the repo for routine dependency updates. | |
| on: | |
| pull_request: | |
| types: [opened, reopened, synchronize, ready_for_review] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| runs-on: ubuntu-latest | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' && !github.event.pull_request.draft | |
| steps: | |
| - name: Fetch dependency metadata | |
| id: meta | |
| uses: dependabot/fetch-metadata@v3 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Enable auto-merge on safe updates | |
| if: | | |
| steps.meta.outputs.update-type == 'version-update:semver-patch' || | |
| steps.meta.outputs.update-type == 'version-update:semver-minor' || | |
| steps.meta.outputs.dependency-type == 'direct:development' || | |
| steps.meta.outputs.package-ecosystem == 'github_actions' || | |
| steps.meta.outputs.package-ecosystem == 'github-actions' | |
| run: gh pr merge --auto --squash --delete-branch "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Label production majors for manual review | |
| if: | | |
| steps.meta.outputs.update-type == 'version-update:semver-major' && | |
| steps.meta.outputs.dependency-type == 'direct:production' | |
| run: | | |
| gh label create "needs-review" \ | |
| --color "fbca04" \ | |
| --description "Dependabot production major bump; needs human review" \ | |
| --repo "$GITHUB_REPOSITORY" \ | |
| 2>/dev/null || true | |
| gh pr edit "$PR_URL" --add-label "needs-review" | |
| gh pr comment "$PR_URL" --body "This is a major bump on a production dependency. Not auto-merging — release notes worth a read first." | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |