From 3c3db0bb90f207c5cf48765fb44d45c0e0cd2e2e Mon Sep 17 00:00:00 2001 From: Wouter Vanden Hove Date: Tue, 3 Nov 2026 16:50:15 +0100 Subject: [PATCH 1/3] Fix invalid auto-merge workflow and pin cyclopts in Renovate - dependabot-auto-merge: drop the `workflows: write` permission. It is not a valid GITHUB_TOKEN scope, so GitHub rejected the whole workflow file and logged a failed "push" run on every commit to main; auto-merge never ran. - renovate: keep cyclopts below 4, matching the pin in pyproject.toml (cyclopts>=4 always sys.exit()s from App.__call__; cyclopts>=5 needs Python>=3.11 while we support >=3.9). Stops Renovate reopening #22. Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d --- .github/workflows/dependabot-auto-merge.yaml | 1 - renovate.json | 7 +++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml index 1954f71..b51e9e8 100644 --- a/.github/workflows/dependabot-auto-merge.yaml +++ b/.github/workflows/dependabot-auto-merge.yaml @@ -28,7 +28,6 @@ jobs: permissions: contents: write # Required to squash/merge/rebase the dependabot PR pull-requests: write # Required to approve and merge the pull request - workflows: write # Required when the dependabot PR itself modifies workflow files # Only run for Dependabot PRs - security: prevent running on PRs from forks or other actors # Uses the PR creator (pull_request.user.login) rather than github.actor, which reflects diff --git a/renovate.json b/renovate.json index 5db72dd..d12c839 100644 --- a/renovate.json +++ b/renovate.json @@ -2,5 +2,12 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:recommended" + ], + "packageRules": [ + { + "description": "cyclopts>=4 makes App.__call__ always sys.exit() (breaks CLI tests); cyclopts>=5 requires Python>=3.11. Keep in sync with pyproject.toml.", + "matchPackageNames": ["cyclopts"], + "allowedVersions": "<4" + } ] } From 3679395a0fcb3778e2736d6802229273afd014aa Mon Sep 17 00:00:00 2001 From: Wouter Vanden Hove Date: Tue, 3 Nov 2026 16:56:04 +0100 Subject: [PATCH 2/3] Remove Dependabot; Renovate handles dependency updates Dependabot and Renovate were both proposing the same updates, producing duplicate PRs. Keep Renovate only: - delete .github/dependabot.yml (version updates for github-actions and uv) - delete .github/workflows/dependabot-auto-merge.yaml, which only served Dependabot PRs (this supersedes the permission fix in the previous commit) Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d --- .github/dependabot.yml | 36 ------------- .github/workflows/dependabot-auto-merge.yaml | 55 -------------------- 2 files changed, 91 deletions(-) delete mode 100644 .github/dependabot.yml delete mode 100644 .github/workflows/dependabot-auto-merge.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 204a4ac..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,36 +0,0 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates - -version: 2 - -updates: - - # supported ecosystems: - # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#package-ecosystem- - - # update for GitHub Actions - - package-ecosystem: github-actions - directory: "/" # will search .github/workflows - labels: - - "dependencies" - - "github_actions" - open-pull-requests-limit: 9 - schedule: - interval: "weekly" - cooldown: - default-days: 7 - - # update uv.lock file - - package-ecosystem: "uv" - directory: "/" - labels: - - "dependencies" - - "python" - - "uv" - open-pull-requests-limit: 9 - schedule: - interval: "monthly" - cooldown: - default-days: 7 diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml deleted file mode 100644 index b51e9e8..0000000 --- a/.github/workflows/dependabot-auto-merge.yaml +++ /dev/null @@ -1,55 +0,0 @@ - -# Security references: -# - https://securitylab.github.com/resources/github-actions-preventing-pwn-requests -# - https://securitylab.github.com/resources/github-actions-untrusted-input -# - https://securitylab.github.com/resources/github-actions-building-blocks -# - https://securitylab.github.com/resources/github-actions-new-patterns-and-mitigations - - -name: Auto Merge Dependabot - -on: - pull_request: - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -permissions: {} - -jobs: - auto-merge: - name: Auto Merge Dependabot - - runs-on: ubuntu-latest - - timeout-minutes: 5 - - permissions: - contents: write # Required to squash/merge/rebase the dependabot PR - pull-requests: write # Required to approve and merge the pull request - - # Only run for Dependabot PRs - security: prevent running on PRs from forks or other actors - # Uses the PR creator (pull_request.user.login) rather than github.actor, which reflects - # the last actor to touch the ref and can be spoofed via a crafted commit history. - if: github.event.pull_request.user.login == 'dependabot[bot]' - - steps: - - # repo: https://github.com/actions/checkout - # releases: https://github.com/actions/checkout/tags - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - # repo: https://github.com/fastify/github-action-merge-dependabot - # releases: https://github.com/fastify/github-action-merge-dependabot/tags - # The action waits for required status checks by default - - uses: fastify/github-action-merge-dependabot@73ec4cbb5e56df5591eae286972d5b2201ffe90f # v3.15.0 - with: - # github-token: ${{ secrets.TOKEN_AUTOMERGE }} - # Using built-in GITHUB_TOKEN for better security (auto-scoped, auto-expires) - # Falls back to TOKEN_AUTOMERGE if GITHUB_TOKEN lacks permissions - github-token: ${{ secrets.GITHUB_TOKEN }} - merge-method: squash # merge|squash|rebase - target: minor From ed08321cc5b4153b525c482dc04f7df15414c5ab Mon Sep 17 00:00:00 2001 From: Wouter Vanden Hove Date: Tue, 3 Nov 2026 17:00:07 +0100 Subject: [PATCH 3/3] Renovate: auto-merge non-major updates after CI passes - auto-merge minor/patch/digest/pin updates and monthly lock file maintenance; majors stay manual - minimumReleaseAge 7 days, so freshly published (possibly yanked) releases are never auto-merged - platformAutomerge=false: main has no required status checks, so GitHub native auto-merge would merge without waiting for CI. Renovate merges itself only once every check on the branch has passed. Claude-Session: https://claude.ai/code/session_01X16aaEYzUw6qwf6co68x5d --- renovate.json | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/renovate.json b/renovate.json index d12c839..ada4957 100644 --- a/renovate.json +++ b/renovate.json @@ -3,7 +3,26 @@ "extends": [ "config:recommended" ], + "labels": ["dependencies"], + "minimumReleaseAge": "7 days", + "platformAutomerge": false, + "automergeStrategy": "squash", + "lockFileMaintenance": { + "enabled": true, + "schedule": ["before 5am on the first day of the month"], + "automerge": true + }, "packageRules": [ + { + "description": "Auto-merge non-major updates once every CI check on the branch has passed. Renovate merges itself (platformAutomerge=false) because main has no required status checks, so GitHub native auto-merge would not wait for CI.", + "matchUpdateTypes": ["minor", "patch", "digest", "pin", "pinDigest", "bump"], + "automerge": true + }, + { + "description": "Major updates always need a manual review.", + "matchUpdateTypes": ["major"], + "automerge": false + }, { "description": "cyclopts>=4 makes App.__call__ always sys.exit() (breaks CLI tests); cyclopts>=5 requires Python>=3.11. Keep in sync with pyproject.toml.", "matchPackageNames": ["cyclopts"],