chore(deps): bump soupsieve from 2.8.4 to 2.9 #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: dependabot-auto-merge | |
| # Enables GitHub native auto-merge for low-risk Dependabot PRs. `--auto` waits | |
| # for required status checks to pass before merging, so a bump that breaks CI | |
| # never lands. Scope: patch and minor only; majors stay manual. | |
| # | |
| # Security notes: | |
| # - Triggers on `pull_request`, NOT `pull_request_target`: this job never | |
| # checks out or executes the PR's code, only reads metadata and calls the | |
| # merge API, so it needs no elevated token or secret exposure. | |
| # - Dependabot-triggered runs get a read-only GITHUB_TOKEN by default; the | |
| # permissions block below re-grants only what the merge call needs. | |
| # - The whole job is gated on the dependabot[bot] actor. | |
| on: pull_request | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| runs-on: ubuntu-latest | |
| if: github.actor == 'dependabot[bot]' | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: meta | |
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 | |
| # For grouped PRs, update-type reflects the highest bump in the group, so | |
| # a group containing a major resolves to semver-major and is left manual. | |
| - name: Enable auto-merge for patch and minor updates | |
| if: >- | |
| steps.meta.outputs.update-type == 'version-update:semver-patch' || | |
| steps.meta.outputs.update-type == 'version-update:semver-minor' | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |