chore(deps-dev): bump the dev-dependencies group across 1 directory with 32 updates #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependabot auto-merge — XStreamRoll | |
| # | |
| # Auto-enables squash auto-merge for Dependabot pull requests that contain | |
| # only patch-level or security updates. Minor and major updates require | |
| # manual review per repo convention. | |
| # | |
| # Requirements (one-time repo setting): | |
| # Settings → General → Pull Requests → "Allow auto-merge" must be enabled. | |
| # | |
| # Behavior: | |
| # - version-update:semver-patch → squash auto-merge (after CI is green) | |
| # - security-update → squash auto-merge (after CI is green) | |
| # - version-update:semver-minor → no auto-merge (manual review) | |
| # - version-update:semver-major → no auto-merge (manual review) | |
| name: Dependabot auto-merge | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| name: Enable auto-merge for patch & security updates | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: meta | |
| uses: dependabot/fetch-metadata@v2 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Enable squash auto-merge | |
| if: contains(fromJSON('["version-update:semver-patch","security-update"]'), steps.meta.outputs.update-type) | |
| uses: actions/github-script@v7 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| await github.rest.pulls.enableAutoMerge({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.payload.pull_request.number, | |
| merge_method: 'squash' | |
| }); | |
| core.info(`Enabled squash auto-merge for Dependabot PR #${context.payload.pull_request.number} (${context.payload.pull_request.title})`); |