Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
16d ago
+104-0

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by cubic

Automates merging green Dependabot version bumps so pm CLI releases reach every package without a hand-written certification PR.

  • .github/dependabot.yml checks npm daily, grouping @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and other minor/patch updates into one dependencies PR.
  • .github/workflows/dependabot-auto-merge.yml enables squash auto-merge for the calendar-versioned pm-toolchain group (year rollovers read as semver-major) and for updates fetch-metadata classifies as minor or patch; anything unclassified or major waits for a person.
  • The workflow only runs for Dependabot PRs in the unbraind org, uses least-privilege permissions, and documents why it needs write scopes.
  • Branch protection still requires the test checks, so a failing bump stays open as a defect.
  • Records the work as pm-ado-14nn and adds a changelog entry.

Same change as the reviewed pilot unbraind/pm-presets#118.

Summary by Sourcery

Automate the safe propagation of Dependabot dependency updates while retaining manual review for major updates outside the pm toolchain.

New Features:

  • Configure daily npm Dependabot updates, grouping the pm toolchain separately from other minor and patch dependencies.
  • Automatically enable squash auto-merge for green non-major Dependabot updates, including calendar-versioned pm-toolchain releases.

Enhancements:

  • Restrict the auto-merge workflow to Dependabot pull requests in the unbraind organization and grant it least-privilege permissions while preserving required status checks.

Chores:

  • Record the change in the project changelog and PM task history.