fix(deps): patch brace-expansion + postcss high-severity advisories #221
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Auto-approve and auto-merge dependency PRs (dependabot[bot], renovate[bot]). | |
| # | |
| # All logic lives in the shared reusable workflow | |
| # netresearch/.github/.github/workflows/auto-merge-deps.yml. This file has ZERO | |
| # step-level `uses:` — the single job is a `uses:` of that reusable. | |
| # | |
| # The former third arm (github-actions[bot] + label 'autorelease: pending', | |
| # i.e. release-please) is REMOVED, not reimplemented in the shared workflow. | |
| # Its approve step was a no-op by construction (skipped for that very author, | |
| # deferring to an APPROVE_TOKEN path that never existed); its merge half ran | |
| # for exactly one PR in this repo's history (#466, 2026-02-16). Releases are | |
| # cut by pushing a signed v* tag via release.when-tagged.yml. See | |
| # netresearch/.github#261. Reviving release-please here means re-adding | |
| # auto-merge for it explicitly. | |
| # | |
| # `merge-strategy: rebase` is REQUIRED here. The reusable auto-detects the | |
| # strategy squash-first, but this repo has squash merges disabled | |
| # (allow_squash_merge=false, allow_merge_commit=true, allow_rebase_merge=true), | |
| # so the detector would fall through to `--merge`. The inline job this file | |
| # replaces ran `gh pr merge --auto --rebase`; the pin preserves that. | |
| # | |
| # SECURITY: This workflow uses pull_request_target, which runs with base branch | |
| # permissions. The reusable only runs gh-CLI review/merge steps gated on | |
| # dependabot/renovate authorship — it never checks out or executes PR head code. | |
| name: Auto-merge dependency PRs | |
| on: # zizmor: ignore[dangerous-triggers] | |
| pull_request_target: | |
| permissions: {} | |
| jobs: | |
| auto-merge: | |
| uses: netresearch/.github/.github/workflows/auto-merge-deps.yml@main | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| with: | |
| merge-strategy: rebase |