Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
10d ago
+88-1

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by Sourcery

Automate the delivery of verified Dependabot updates while consolidating pm toolchain bumps into a daily release PR.

New Features:

  • Automatically enable squash auto-merge for green, non-major Dependabot updates, including the grouped pm toolchain updates.
  • Group the pm CLI and related packages into a daily Dependabot pull request.

Enhancements:

  • Keep major and unclassified dependency updates subject to manual review while required status checks continue to gate merges.
  • Restrict workflow permissions to the auto-merge job and pin the Dependabot metadata action.

CI:

  • Add a Dependabot auto-merge workflow scoped to Dependabot pull requests in the unbraind organization.

Chores:

  • Record the change in the project changelog and pm task history.

Summary by cubic

Auto-merges green Dependabot updates so pm toolchain version bumps reach every package without a hand-written certification PR.

  • Dependabot now checks npm daily and groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR; other minor/patch updates land as a separate, disjoint dependencies PR.
  • A new dependabot-auto-merge.yml workflow runs only for Dependabot PRs in unbraind and enables squash auto-merge for all pm-toolchain PRs (calendar-versioned, so a year rollover reads as semver-major) and for any other update explicitly classified as minor or patch; an unclassified or major update waits for a person.
  • The workflow keeps empty default permissions; only the job gets contents: write and pull-requests: write. Branch protection still requires test (22) and test (26), so a failing bump stays open as a defect.

Rolled out from the reviewed pilot unbraind/pm-presets#118.