Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
11d ago
+93-1

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (26), test (22.18.0), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by Sourcery

Automate the safe landing of green Dependabot updates while delivering pm toolchain releases as grouped daily updates.

New Features:

  • Configure daily npm Dependabot updates with grouped pull requests for the pm toolchain and other minor or patch dependencies.

Enhancements:

  • Automatically enable squash auto-merge for green non-major Dependabot updates, including calendar-versioned pm toolchain releases, while leaving major non-toolchain updates for manual review.
  • Limit the auto-merge workflow to Dependabot pull requests in the target organization and grant write permissions only to the job that performs merges.

CI:

  • Add a Dependabot auto-merge workflow that waits for required branch-protection checks before merging.

Documentation:

  • Document the Dependabot automation and pm toolchain grouping in the unreleased changelog.

Chores:

  • Record the associated pm task and history metadata.

Summary by cubic

Automates the landing of green Dependabot updates so pm toolchain version bumps reach the fleet without a hand-written certification PR.

  • npm checks run daily instead of weekly; @unbrained/pm-cli and pm-* packages arrive grouped in one pm-toolchain PR, and other minor/patch updates in one dependencies PR.
  • A least-privilege workflow enables squash auto-merge for the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and, outside it, only for updates classified minor or patch; anything major or unclassified waits for a person.
  • Branch protection still gates on required checks, so a bump that fails CI stays open as a defect.

Same change as the reviewed pilot unbraind/pm-presets#118.