mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-14 14:40:52 +00:00
Marc-André Bombeck
c5fc707e59
The workflow granted contents: write and pull-requests: write at the top level, so every step in the run held them, including the checkout and the dependency install that execute code from the pull request being merged. Scorecard flags the shape, and the shape is the problem: a compromised transitive in a Dependabot branch would run with a token that can write to the repository. The workflow default is contents: read now, and the two write scopes sit on the auto-merge job, which is the only job there is and the only place they are spent. gh pr merge --auto needs contents: write to enable merge-on-green and pull-requests: write to act on the pull request; the major-bump comment needs pull-requests: write. The metadata fetch and the test run need neither. Nothing about which updates merge automatically changes.
67 lines
2.4 KiB
YAML
67 lines
2.4 KiB
YAML
name: Auto-merge Dependabot
|
|
|
|
on: pull_request
|
|
|
|
# Nothing outside the one job needs more than a checkout, so the default for
|
|
# the workflow is read-only and the write scopes sit on the job that spends
|
|
# them: `gh pr merge --auto` writes to the repository's merge queue state, and
|
|
# both the merge and the review comment write to the pull request.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
auto-merge:
|
|
runs-on: ubuntu-latest
|
|
if: github.actor == 'dependabot[bot]'
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- run: pnpm db:generate
|
|
|
|
- run: pnpm test
|
|
|
|
# Auto-merge is gated on the Dependabot-declared update type:
|
|
# patch and minor bumps merge once required checks pass; major
|
|
# bumps get a comment and wait for the maintainer. A major bump
|
|
# routinely carries breaking changes the unit suite alone cannot
|
|
# vouch for.
|
|
- name: Fetch Dependabot metadata
|
|
id: metadata
|
|
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Enable auto-merge (patch / minor only)
|
|
if: >-
|
|
steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
|
|
steps.metadata.outputs.update-type == 'version-update:semver-minor'
|
|
run: gh pr merge --auto --squash "$PR_URL"
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Flag major update for manual review
|
|
if: steps.metadata.outputs.update-type == 'version-update:semver-major'
|
|
run: >-
|
|
gh pr comment "$PR_URL" --body
|
|
"Major version bump (${DEP_NAMES}) — auto-merge is intentionally
|
|
disabled for semver-major updates. Review the upstream changelog
|
|
and merge manually."
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|