chore(main): release 0.4.4 #1597
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto-approve | |
| # pull_request: same-repo / Dependabot (workflow file from PR head must keep this | |
| # so open PRs that touch this file still fire auto-approve). | |
| # pull_request_target: secrets for fork PRs (pull_request has Secret source: None). | |
| # Safe: no checkout of untrusted PR head; only gh approve/merge via App token. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: "PR number to approve (workflow_dispatch only)" | |
| required: false | |
| type: string | |
| # Include event name so pull_request and pull_request_target never cancel | |
| # each other. A cancelled twin shows as a red Auto-approve check even when | |
| # the winner succeeded (Dependabot #1505 / #1507). | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| auto-approve: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| # Skip self-approve deadlock. Run for maintainer actor, Dependabot, bots, | |
| # or any PR when dispatched manually with pr_number. | |
| # Same-repo PRs (Dependabot) use pull_request only. Forks use | |
| # pull_request_target only (secrets). Running both on the same PR | |
| # cancelled one job and painted a false red check. | |
| if: >- | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event.pull_request.user.login != 'github-actions[bot]' && | |
| ((github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository) || | |
| (github.event_name == 'pull_request_target' && | |
| github.event.pull_request.head.repo.full_name != github.repository)) && | |
| (github.actor == 'SebTardif' || | |
| github.event.pull_request.user.login == 'dependabot[bot]' || | |
| endsWith(github.event.pull_request.user.login, '[bot]'))) | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0 | |
| with: | |
| egress-policy: audit | |
| # App token first: required for fork PRs (GITHUB_TOKEN cannot review them) | |
| # and for require_last_push_approval when a human was the last pusher. | |
| - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| id: app-token | |
| continue-on-error: true | |
| with: | |
| client-id: ${{ vars.AUTO_APPROVE_CLIENT_ID }} | |
| private-key: ${{ secrets.AUTO_APPROVE_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-pull-requests: write | |
| permission-workflows: write | |
| - name: Resolve PR number | |
| id: pr | |
| env: | |
| EVENT_PR: ${{ github.event.pull_request.number }} | |
| INPUT_PR: ${{ github.event.inputs.pr_number }} | |
| run: | | |
| n="${EVENT_PR:-${INPUT_PR}}" | |
| if [ -z "$n" ]; then | |
| echo "No PR number" >&2 | |
| exit 1 | |
| fi | |
| echo "number=$n" >> "$GITHUB_OUTPUT" | |
| - name: Approve PR | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| PR_NUMBER: ${{ steps.pr.outputs.number }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| gh pr review --approve "${PR_NUMBER}" --repo "${REPO}" \ | |
| || echo "Approve failed or already approved; continuing." | |
| - name: Enable auto-merge | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }} | |
| APP_TOKEN: ${{ steps.app-token.outputs.token }} | |
| PR_NUMBER: ${{ steps.pr.outputs.number }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| if [ -z "${APP_TOKEN}" ]; then | |
| echo "App token unavailable; using GITHUB_TOKEN for auto-merge." | |
| fi | |
| # Never auto-merge release-please PRs. | |
| labels=$(gh pr view "${PR_NUMBER}" --repo "${REPO}" --json labels --jq '[.labels[].name] | join(",")') | |
| case ",$labels," in | |
| *",autorelease: pending,"*) | |
| echo "Skipping auto-merge for release-please PR" | |
| exit 0 | |
| ;; | |
| esac | |
| gh pr merge --auto --squash "${PR_NUMBER}" --repo "${REPO}" \ | |
| || echo "Could not enable auto-merge; PR may still need green checks or manual merge." |