ci: Bump the actions group across 1 directory with 5 updates #421
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # Auto-merge EVERY green Dependabot PR — majors INCLUDED (repo owner's decision, | |
| # 2026-07-27; widened from the previous patch/minor-only scope). `--auto` enqueues a | |
| # squash-merge that GitHub completes ONLY once the required checks (lint + test) pass, | |
| # so a red check still blocks the merge — "on green" is the gate, not update size. | |
| # | |
| # Runs on GitHub-hosted ubuntu-latest, NOT the self-hosted protector-runners: this job | |
| # is just two `gh` calls, so it needs none of the in-cluster sccache/buildkit those | |
| # runners exist for, and keeping it off them avoids contending with the heavy rust jobs. | |
| # | |
| # Depends on two one-time repo settings that cannot be set from a PR: | |
| # 1. "Allow auto-merge" enabled in repo settings. | |
| # 2. Branch protection on main requiring `lint` + `test` (and NOT the path-skipped | |
| # `docker` check). | |
| permissions: | |
| contents: read | |
| on: | |
| # pull_request (not pull_request_target): the only token need is the job's | |
| # GITHUB_TOKEN with contents+pull-requests write, which `pull_request` grants for | |
| # Dependabot events. pull_request_target would run with a broader token we don't need. | |
| pull_request: | |
| branches: ["main"] | |
| jobs: | |
| automerge: | |
| runs-on: ubuntu-latest | |
| # Only act on Dependabot's own PRs. | |
| if: github.actor == 'dependabot[bot]' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: Approve the PR | |
| # Dependabot cannot approve its own PR, so do it here to satisfy any | |
| # "1 approval" branch-protection rule. No update-type gate — all bumps. | |
| run: gh pr review --approve "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Enable auto-merge | |
| # Squash + delete-branch to match the repo's manual merge convention. | |
| # `--auto` waits for the required checks; ALL update types, majors included. | |
| run: gh pr merge --auto --squash --delete-branch "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |