Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
11d ago
+93-1

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by Sourcery

Streamline Dependabot maintenance by grouping daily npm updates and automatically merging eligible updates after required checks pass.

New Features:

  • Automate squash auto-merging of eligible green Dependabot pull requests while leaving major or unclassified updates for manual review.

Enhancements:

  • Run npm dependency checks daily and group the PM toolchain into a dedicated daily update pull request, with other minor and patch updates grouped separately.

CI:

  • Add a least-privilege workflow that enables auto-merge only for Dependabot pull requests in the target repository and relies on required status checks.

Deployment:

  • Enable repository auto-merge and automatic deletion of merged branches.

Summary by cubic

Automates the delivery of Dependabot updates so green version bumps merge without manual work.

Dependabot now checks npm daily and groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR, with all other minor/patch updates in a separate dependencies PR. A new least-privilege workflow enables squash auto-merge for the calendar-versioned pm-toolchain group (a year rollover reads as semver-major) and for updates that dependabot/fetch-metadata explicitly classifies as minor or patch; an unclassified update never auto-merges. Branch protection still requires the test checks, so a failing bump stays open as a defect, and major updates still need a person. Repository auto-merge is enabled and merged branches are deleted.