fix(deps): patch brace-expansion + postcss high-severity advisories #168
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Solo-maintainer auto-approve: approves PRs whose author holds `admin` or | |
| # `write` permission on this repository, so that | |
| # required_approving_review_count >= 1 is satisfied without manual review. | |
| # | |
| # All logic lives in the shared reusable workflow | |
| # netresearch/.github/.github/workflows/pr-quality.yml. This file has ZERO | |
| # step-level `uses:` — every job is a `uses:` of that reusable. | |
| # | |
| # `auto-approve-require-write: true` is REQUIRED here: the reusable's default | |
| # authorization test is `author_association` (OWNER/MEMBER/COLLABORATOR), | |
| # which is not a permission — it also matches read/triage collaborators. The | |
| # opt-in replaces it with `GET /repos/{repo}/collaborators/{author}/permission` | |
| # and approves only on `admin`/`write`, matching what this repo enforced | |
| # before the migration. | |
| # | |
| # Bot PRs (dependabot[bot], renovate[bot]) are approved by auto-merge-deps.yml, | |
| # not here. See the PR that introduced this file for the evidence. | |
| # | |
| # SECURITY: This workflow uses pull_request_target, which runs with base branch | |
| # permissions. Never add a step that executes content from the PR head. | |
| name: PR Quality Gates | |
| on: | |
| pull_request_target: | |
| # `ready_for_review` compensates for the reusable's `draft == false` | |
| # guard: without it a PR opened as a draft would never be approved | |
| # until its next push. | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: {} | |
| jobs: | |
| pr-quality: | |
| name: PR Quality | |
| uses: netresearch/.github/.github/workflows/pr-quality.yml@main | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| with: | |
| auto-approve-require-write: true | |
| auto-approve-message: "**Automated approval for collaborator PR**\n\nThe author holds `admin` or `write` permission on this repository, which satisfies the single required approval. Copilot review runs separately via the org ruleset." |