Shared CI and Dependabot auto-merge

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ":arrow_up:"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ":arrow_up:"

.github/workflows/building.yaml

@@ -20,7 +20,7 @@ jobs:
           - target: x86_64-apple-darwin
             archive: zip
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v7
       - name: Compile and release
         uses: rust-build/rust-build.action@latest
         env:

.github/workflows/cd.yaml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout 🛎️
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Install and Build 🔧
         run: |

.github/workflows/ci.yaml

@@ -1,27 +1,27 @@
 name: CI
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
 
 jobs:
-  check:
-    name: Rust project
+  ci:
+    name: CI
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - name: Install latest nightly
-        uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
         with:
-          toolchain: nightly
-          override: true
           components: clippy, rustfmt
-
-      - name: Run clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-
-      - name: Run fmt
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --all -- --check
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --all --check
+      - run: cargo clippy --workspace --all-targets -- -D warnings
+      - run: cargo build --workspace
+      - run: cargo test --workspace

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,39 @@
+name: Dependabot Auto Merge
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot-auto-merge:
+    name: Dependabot Auto Merge
+    runs-on: ubuntu-latest
+
+    if: >-
+      github.event.pull_request.user.login == 'dependabot[bot]'
+
+    steps:
+      # Every update type, majors included: the ruleset's required CI check decides
+      # whether it actually merges (auto-merge waits for it).
+      #
+      # The built-in token can never merge a PR that edits .github/workflows/*
+      # ("refusing to allow a GitHub App to create or update workflow ... without workflows
+      # permission"), which is what Dependabot's action-version bumps are. Those are left for a
+      # human or the sweep tool instead of failing this job.
+      - name: Enable auto-merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          if gh pr diff "$PR_URL" --name-only | grep -q '^\.github/workflows/'; then
+            echo "::notice::This PR edits workflow files, which the built-in token cannot merge. Merge it by hand."
+            exit 0
+          fi
+          gh pr merge --auto --squash "$PR_URL"

src/main.rs

@@ -6,7 +6,7 @@ use std::env::args;
 fn get_message_to_print_until_die() -> String {
     let args: Vec<String> = args().skip(1).collect();
 
-    if args.len() >= 1 {
+    if !args.is_empty() {
         args.join(" ")
     } else {
         "y".to_string()