Merge pull request #467 from openwallet-foundation-labs/feat/dependabot-automation

feat: add Dependabot automation workflows

Author: cre8

.github/workflows/check-stale-overrides.yml

@@ -0,0 +1,116 @@
+name: Check Stale Overrides
+
+permissions:
+  contents: read
+  issues: write
+
+on:
+  schedule:
+    - cron: '0 6 * * 1' # Weekly on Monday 6 AM UTC
+  workflow_dispatch: # Manual trigger
+
+jobs:
+  check-overrides:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check for stale overrides
+        id: check
+        run: |
+          # Extract overrides from package.json
+          OVERRIDES=$(node -e "
+            const pkg = require('./package.json');
+            const overrides = pkg.pnpm?.overrides || {};
+            Object.entries(overrides).forEach(([name, version]) => {
+              console.log(name + '@' + version);
+            });
+          ")
+          
+          if [ -z "$OVERRIDES" ]; then
+            echo "No pnpm overrides configured"
+            echo "has_overrides=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+          
+          echo "has_overrides=true" >> $GITHUB_OUTPUT
+          echo "## Current pnpm.overrides" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "The following overrides are pinned in package.json:" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "$OVERRIDES" >> $GITHUB_STEP_SUMMARY
+          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "### Action Required" >> $GITHUB_STEP_SUMMARY
+          echo "Check if parent packages have been updated to use fixed versions of these dependencies." >> $GITHUB_STEP_SUMMARY
+          echo "If so, remove the override from \`package.json\` and run \`pnpm install\`." >> $GITHUB_STEP_SUMMARY
+
+      - name: Create issue if overrides exist
+        if: steps.check.outputs.has_overrides == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const pkg = require('./package.json');
+            const overrides = pkg.pnpm?.overrides || {};
+            
+            if (Object.keys(overrides).length === 0) return;
+            
+            // Check if issue already exists
+            const issues = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              labels: 'stale-overrides',
+              state: 'open'
+            });
+            
+            if (issues.data.length > 0) {
+              console.log('Issue already exists, skipping');
+              return;
+            }
+            
+            const overrideList = Object.entries(overrides)
+              .map(([name, version]) => `- \`${name}\`: ${version}`)
+              .join('\n');
+            
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: 'Review pnpm.overrides for stale security fixes',
+              labels: ['stale-overrides', 'dependencies'],
+              body: `## Stale Override Check
+
+The following subdependency overrides are configured in \`package.json\`:
+
+${overrideList}
+
+### Action Required
+
+1. Check if the parent packages have been updated to include fixed versions
+2. Remove any overrides that are no longer needed:
+   - Edit \`package.json\` and remove the override from \`pnpm.overrides\`
+   - Run \`pnpm install\` to update the lockfile
+   - Verify the vulnerability is resolved with \`pnpm audit\`
+
+### Why This Matters
+
+Overrides pin subdependencies to specific versions. Once upstream packages are fixed, these overrides become stale and may:
+- Prevent you from getting newer fixes
+- Create version conflicts
+- Make \`pnpm audit\` report false negatives
+
+---
+*This issue was automatically created by the stale-overrides workflow.*`
+            });

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,40 @@
+name: Dependabot Auto-Approve
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      # Auto-approve patch updates to reduce friction
+      # Still requires CI to pass and manual merge for production dependencies
+      - name: Auto-approve patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Only auto-merge for DEVELOPMENT dependencies (test tools, linters, etc.)
+      # Production/runtime dependencies still require manual merge after CI passes
+      - name: Enable auto-merge for dev dependency patches only
+        if: |
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' &&
+          steps.metadata.outputs.dependency-type == 'direct:development'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}