Auto-merge green Dependabot updates and group the pm toolchain into one daily PR

Merged
UN
19d ago
+93-1

What

  • .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
  • .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
  • Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

Summary by cubic

Auto-merges green Dependabot updates and groups the pm toolchain into one daily PR, so version bumps land without a hand-written certification PR.

  • npm is now checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, and all other dependencies as a disjoint dependencies PR.
  • A least-privilege workflow enables GitHub squash auto-merge; branch protection still requires the test checks, so a failing bump stays open as a defect.
  • The pm-toolchain group is calendar-versioned, so a year rollover reads as semver-major and still auto-merges; outside that group, only updates classified minor or patch auto-merge, so anything major or unclassified waits for a person.
  • Requires the repository setting that allows auto-merge; no manual rollout steps needed.

Summary by Sourcery

Automate safe Dependabot updates and coordinate daily pm toolchain version bumps through grouped pull requests.

New Features:

  • Automatically enable squash auto-merge for eligible green Dependabot pull requests while leaving major or unclassified updates for manual review.

Enhancements:

  • Group the pm CLI toolchain into a single daily Dependabot pull request and consolidate other minor and patch npm updates separately.

Chores:

  • Allow repository auto-merge and configure merged branches for deletion.