mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-13 14:32:03 +00:00
Marc-André Bombeck
d7bf0df10b
Every workflow action is pinned to a commit SHA, dependabot auto-merge is limited to patch and minor updates behind the now-required status checks on main, and the audit, Trivy and ESLint gates block instead of warning. The published image finally carries its build SHA and build timestamp so the version endpoint can prove which commit is running. The API-token HMAC key fails closed under 32 characters, compose pins the database minor and denies privilege escalation, and the changelog drops working-note references in favour of neutral wording.
61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
name: Auto-merge Dependabot
|
|
|
|
on: pull_request
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
auto-merge:
|
|
runs-on: ubuntu-latest
|
|
if: github.actor == 'dependabot[bot]'
|
|
|
|
steps:
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
|
|
|
|
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- run: pnpm db:generate
|
|
|
|
- run: pnpm test
|
|
|
|
# Auto-merge is gated on the Dependabot-declared update type:
|
|
# patch and minor bumps merge once required checks pass; major
|
|
# bumps get a comment and wait for the maintainer. A major bump
|
|
# routinely carries breaking changes the unit suite alone cannot
|
|
# vouch for.
|
|
- name: Fetch Dependabot metadata
|
|
id: metadata
|
|
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Enable auto-merge (patch / minor only)
|
|
if: >-
|
|
steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
|
|
steps.metadata.outputs.update-type == 'version-update:semver-minor'
|
|
run: gh pr merge --auto --squash "$PR_URL"
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Flag major update for manual review
|
|
if: steps.metadata.outputs.update-type == 'version-update:semver-major'
|
|
run: >-
|
|
gh pr comment "$PR_URL" --body
|
|
"Major version bump (${DEP_NAMES}) — auto-merge is intentionally
|
|
disabled for semver-major updates. Review the upstream changelog
|
|
and merge manually."
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|