Repository navigation
chore(deps-dev): bump @types/vscode from 1.103.0 to 1.140.0 in the npm-minor-patch group across 1 directory #29
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | ||
|
Check warning on line 1 in .github/workflows/dependabot-auto-merge.yml
|
||
| # Arms auto-merge on Dependabot's patch and minor security updates. GitHub merges | ||
| # them only after the required human review and branch-protection checks pass. | ||
| # | ||
| # Major bumps are deliberately excluded: they are the ones that break builds, and | ||
| # they stay open for a human to read. | ||
| # | ||
| # No step approves anything. Human review remains independent from the bot that | ||
| # opened the pull request, while a green build can merge automatically afterward. | ||
| # | ||
| # Why pull_request_target and not pull_request: GitHub treats Dependabot runs as if | ||
| # they came from a fork, so on `pull_request` the GITHUB_TOKEN is read-only and | ||
| # cannot enable auto-merge. `pull_request_target` runs in the base repository's | ||
| # context with a writable token. That trigger is dangerous when a workflow checks | ||
| # out and runs the pull request's code, because untrusted code would inherit those | ||
| # permissions — this workflow never checks out the PR, it only reads metadata and | ||
| # calls the API. | ||
| on: | ||
| pull_request_target: | ||
| types: | ||
| - opened | ||
| - reopened | ||
| - synchronize | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| jobs: | ||
| auto-merge: | ||
| # Check the author rather than the actor, so the job cannot be driven by a | ||
| # pull request someone else opened. | ||
| if: github.event.pull_request.user.login == 'dependabot[bot]' | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
| concurrency: | ||
| group: dependabot-auto-merge-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: true | ||
| steps: | ||
| - name: Fetch Dependabot metadata | ||
| id: meta | ||
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 | ||
| - name: Enable auto-merge for patch and minor updates | ||
| if: | | ||
| steps.meta.outputs.update-type == 'version-update:semver-patch' || | ||
| steps.meta.outputs.update-type == 'version-update:semver-minor' | ||
| run: gh pr merge --auto --squash --match-head-commit "$PR_HEAD_SHA" "$PR_URL" | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Leave major updates for manual review | ||
| if: steps.meta.outputs.update-type == 'version-update:semver-major' | ||
| run: | | ||
| echo "::notice::Major update ($DEPENDENCY_NAMES) left for manual review." | ||
| env: | ||
| DEPENDENCY_NAMES: ${{ steps.meta.outputs.dependency-names }} | ||
