cloudhal-update.yml

name: Cloudhal update

# Checks every PR (Dependabot's Cloudhal bumps included): install, then bundle both Workers in
# Workers Builds mode without deploying. Dependabot PRs that only move @cloudhal/* by a patch
# version are merged once the check passes; minor and major bumps wait for a person (in 0.x a
# minor version may break). Merging to main deploys through Workers Builds, and
# scripts/post-deploy-check.mjs rolls back if the site or Studio stops answering.

on:
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 24
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - name: Bundle both Workers (no deploy)
        run: pnpm exec cloudhal deploy --dry-run
        env:
          WORKERS_CI: "1"

  merge:
    needs: check
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - id: meta
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
      - name: Merge a patch release
        if: steps.meta.outputs.update-type == 'version-update:semver-patch'
        run: gh pr merge "$PR" --auto --merge --repo "$GITHUB_REPOSITORY"
        env:
          PR: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Leave minor and major releases to a person
        if: steps.meta.outputs.update-type != 'version-update:semver-patch'
        run: echo "::notice::${{ steps.meta.outputs.new-version }} is not a patch release; merge it by hand after a look."