Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
1mo ago
+93-1

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by cubic

Automates Dependabot version bumps for unbraind: npm is now checked daily, pm toolchain packages are grouped into one pm-toolchain PR, and eligible Dependabot PRs get GitHub squash auto-merge that lands as soon as required checks pass.

  • The pm-toolchain group has no update-types filter, so a calendar-version year rollover (2026.x → 2027.x) still auto-merges; other minor/patch updates land in a disjoint dependencies group.
  • Only updates dependabot/fetch-metadata classifies as minor or patch auto-merge outside the pm-toolchain group; a major or unclassified update waits for a person, and a bump that fails CI stays open as a defect under branch protection.
  • The workflow runs only for Dependabot PRs in unbraind, uses SHA-pinned dependabot/fetch-metadata, and grants contents and pull-requests write to the job alone.

Summary by Sourcery

Automate safe Dependabot maintenance by grouping daily npm updates and auto-merging eligible changes after required checks pass.

New Features:

  • Group npm toolchain updates into a dedicated daily Dependabot pull request and consolidate other minor and patch updates separately.

Enhancements:

  • Automatically enable squash auto-merge for eligible green Dependabot updates while retaining manual approval for major or unclassified updates.

Chores:

  • Allow repository auto-merge and delete branches after merging Dependabot updates.