Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
15d ago
+93-1

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by Sourcery

Automate the delivery of passing Dependabot updates while preserving required checks and human review for major dependency changes.

New Features:

  • Configure daily npm dependency checks with grouped pull requests for the PM toolchain and other minor or patch updates.
  • Enable automatic squash merging for eligible green Dependabot pull requests while leaving major updates for manual review.

Enhancements:

  • Apply least-privilege permissions to the Dependabot auto-merge workflow and pin its metadata action.

Chores:

  • Record the dependency automation work in the PM task history and changelog.

Summary by cubic

Automates mechanical dependency bumps so green Dependabot PRs merge without a hand-written certification PR.

Dependabot checks npm daily and groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and other minor/patch updates into one dependencies PR. A least-privilege workflow enables GitHub squash auto-merge as soon as the required checks pass; a failing bump stays open as a defect.

  • pm-toolchain is calendar-versioned, so a year rollover reads as semver-major and still auto-merges; everything else auto-merges only when dependabot/fetch-metadata classifies it minor or patch, so an unclassified update waits for a person.
  • The workflow grants contents: write and pull-requests: write to its job only, with dependabot/fetch-metadata SHA-pinned at v3.1.0.
  • Records the work in pm item pm-beads-lgqs and the changelog.