Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
10d ago
+114-2

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), windows-acceptance-launcher (22), windows-acceptance-launcher (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by Sourcery

Automate the delivery of approved Dependabot updates while grouping pm toolchain releases into a daily update.

New Features:

  • Enable daily npm dependency checks with grouped pull requests for the pm toolchain and other minor or patch updates.
  • Automatically enable squash auto-merge for green, non-major Dependabot updates while allowing calendar-versioned pm toolchain releases to merge unattended.

Enhancements:

  • Restrict the auto-merge workflow with least-privilege permissions and repository-specific Dependabot filtering.

CI:

  • Add a Dependabot auto-merge workflow gated by required status checks.

Chores:

  • Record the pm-vcs task and update the changelog and self-hosting bundle.

Summary by cubic

Auto-merges green Dependabot updates so pm toolchain version bumps land without a hand-written certification PR, mirroring the reviewed pilot unbraind/pm-presets#118.

  • Dependabot now checks npm daily; @unbrained/pm-cli and pm-* packages group into one pm-toolchain PR, and other minor/patch updates into a dependencies PR.
  • A new least-privilege workflow enables squash auto-merge only for updates fetch-metadata classifies as minor or patch, or for the pm-toolchain group; a failing or unclassified update stays open for a person.
  • The pm-toolchain group has no update-type filter because pm uses calendar versions, so a year rollover (2026.x → 2027.x) reads as semver-major and still merges unattended.