mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-09 04:50:59 +00:00
dependabot[bot]
037f44d473
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
84 lines
3.3 KiB
YAML
84 lines
3.3 KiB
YAML
name: Auto-merge Dependabot
|
|
|
|
on: pull_request
|
|
|
|
# Nothing outside the one job needs more than a checkout, so the default for
|
|
# the workflow is read-only and the write scopes sit on the job that spends
|
|
# them: `gh pr merge --auto` writes to the repository's merge queue state, and
|
|
# both the merge and the review comment write to the pull request.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
auto-merge:
|
|
runs-on: ubuntu-24.04
|
|
if: github.actor == 'dependabot[bot]'
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
|
|
|
|
- uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
|
|
with:
|
|
node-version: 22
|
|
cache: "pnpm"
|
|
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- run: pnpm db:generate
|
|
|
|
# The hero-geometry check in the unit suite renders the real panel in a
|
|
# real browser and measures the boxes, and it refuses to skip when CI is
|
|
# set — a check that skips measures nothing. This job runs the same suite
|
|
# as the quality job in `security.yml` and needs the same browser: without
|
|
# it every Dependabot pull request went red on a launch failure that said
|
|
# nothing about the bump (four of them on 2026-09-06 alone). Headless
|
|
# shell only, matching that job.
|
|
- name: Cache Playwright headless shell
|
|
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
|
with:
|
|
path: ~/.cache/ms-playwright
|
|
key: playwright-shell-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
|
|
restore-keys: |
|
|
playwright-shell-${{ runner.os }}-
|
|
|
|
- run: pnpm exec playwright install --only-shell chromium
|
|
|
|
- run: pnpm test
|
|
|
|
# Auto-merge is gated on the Dependabot-declared update type:
|
|
# patch and minor bumps merge once required checks pass; major
|
|
# bumps get a comment and wait for the maintainer. A major bump
|
|
# routinely carries breaking changes the unit suite alone cannot
|
|
# vouch for.
|
|
- name: Fetch Dependabot metadata
|
|
id: metadata
|
|
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Enable auto-merge (patch / minor only)
|
|
if: >-
|
|
steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
|
|
steps.metadata.outputs.update-type == 'version-update:semver-minor'
|
|
run: gh pr merge --auto --squash "$PR_URL"
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Flag major update for manual review
|
|
if: steps.metadata.outputs.update-type == 'version-update:semver-major'
|
|
run: >-
|
|
gh pr comment "$PR_URL" --body
|
|
"Major version bump (${DEP_NAMES}) — auto-merge is intentionally
|
|
disabled for semver-major updates. Review the upstream changelog
|
|
and merge manually."
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|