Automate Dependabot approvals (#2176)

* Automate Dependabot approvals

* Fix Dependabot security update detection

* Strengthen Dependabot workflow guards

* Format Dependabot workflow tests

* Pin Dependabot workflow step ordering

* Restrict major security auto-approval

* Make CodeQL a required merge gate

Author: julienld

.github/workflows/codeql-quality.yml

@@ -18,9 +18,7 @@ name: CodeQL Code Quality
 #   - javascript  scans the JS/TS family (.js/.mjs/.cjs/.ts/.tsx/.jsx) across the
 #                 whole tree — first-party src/, the Astro site's .mjs config,
 #                 and test JS; the same PATHS_IGNORE drops the vendored fixture
-#                 tree. (CodeQL does not extract .astro component scripts, but
-#                 .astro is in the path triggers below so site/ edits still run
-#                 the gate.)
+#                 tree. (CodeQL does not extract .astro component scripts.)
 #
 # Why a custom workflow instead of GitHub's Code Quality page:
 #   - GitHub Code Quality (Preview) is gated to Team/Enterprise Cloud org plans;
@@ -37,17 +35,6 @@ permissions:
 on:
   pull_request:
     branches: [ master ]
-    paths:
-      - '**.py'
-      - '**.js'
-      - '**.mjs'
-      - '**.cjs'
-      - '**.jsx'
-      - '**.ts'
-      - '**.tsx'
-      - '**.astro'
-      - '.github/workflows/codeql-quality.yml'
-      - 'scripts/codeql_quality_gate.py'
   push:
     branches: [ master ]
     paths:
@@ -128,3 +115,12 @@ jobs:
 
       - name: Gate on findings
         run: python scripts/codeql_quality_gate.py quality.sarif
+
+  code-quality-gate:
+    name: CodeQL Gate
+    if: ${{ always() }}
+    needs: code-quality
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every CodeQL analysis to pass
+        run: test "${{ needs.code-quality.result }}" = "success"

.github/workflows/dependabot-auto-merge.yml

@@ -8,17 +8,35 @@ permissions:
 
 jobs:
   dependabot:
-    if: github.actor == 'dependabot[bot]'
+    if: >-
+      github.actor == 'dependabot[bot]' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
         with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
+          github-token: "${{ secrets.DEPENDABOT_APPROVAL_TOKEN }}"
+          alert-lookup: true
+
+      - name: Approve eligible Dependabot PR
+        if: ${{ (steps.metadata.outputs.alert-state == 'OPEN' && !contains(steps.metadata.outputs.dependency-names, ',')) || contains(fromJson('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type) }}
+        run: |
+          gh api --method POST \
+            "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews" \
+            -f event=APPROVE \
+            -f commit_id="$HEAD_SHA" \
+            -f body="Automated approval: verified Dependabot update; required checks remain authoritative."
+        env:
+          # This must be a Dependabot secret owned by a maintainers-team member.
+          GH_TOKEN: ${{ secrets.DEPENDABOT_APPROVAL_TOKEN }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
 
       - name: Enable auto-merge for Dependabot PRs
-        if: ${{ steps.metadata.outputs.update-type == 'security-update' || contains(fromJson('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type) }}
+        if: ${{ (steps.metadata.outputs.alert-state == 'OPEN' && !contains(steps.metadata.outputs.dependency-names, ',')) || contains(fromJson('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type) }}
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}

tests/src/unit/test_codeql_workflow_shape.py

@@ -0,0 +1,29 @@
+"""Guard the always-reported CodeQL merge gate."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+_REPO_ROOT = Path(__file__).resolve().parents[3]
+_WORKFLOW = _REPO_ROOT / ".github" / "workflows" / "codeql-quality.yml"
+
+
+def _workflow() -> dict[str, Any]:
+    return yaml.safe_load(_WORKFLOW.read_text(encoding="utf-8"))
+
+
+def test_pull_requests_always_emit_codeql_gate() -> None:
+    workflow = _workflow()
+    pull_request = workflow[True]["pull_request"]
+    gate = workflow["jobs"]["code-quality-gate"]
+
+    assert "paths" not in pull_request
+    assert gate["name"] == "CodeQL Gate"
+    assert gate["needs"] == "code-quality"
+    assert gate["if"] == "${{ always() }}"
+    assert gate["steps"][0]["run"] == (
+        'test "${{ needs.code-quality.result }}" = "success"'
+    )

tests/src/unit/test_dependabot_auto_merge_shape.py

@@ -0,0 +1,70 @@
+"""Guard the security-sensitive wiring of Dependabot auto-merge."""
+
+from __future__ import annotations
+
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+_REPO_ROOT = Path(__file__).resolve().parents[3]
+_WORKFLOW = _REPO_ROOT / ".github" / "workflows" / "dependabot-auto-merge.yml"
+
+
+def _workflow() -> dict[str, Any]:
+    return yaml.safe_load(_WORKFLOW.read_text(encoding="utf-8"))
+
+
+def _normalize(value: str) -> str:
+    return " ".join(value.split())
+
+
+def test_metadata_fetches_security_alert_state_with_approval_token() -> None:
+    job = _workflow()["jobs"]["dependabot"]
+    steps = job["steps"]
+    metadata = next(step for step in steps if step.get("id") == "metadata")
+
+    assert _normalize(job["if"]) == _normalize(
+        "github.actor == 'dependabot[bot]' && "
+        "github.event.pull_request.user.login == 'dependabot[bot]' && "
+        "github.event.pull_request.head.repo.full_name == github.repository"
+    )
+    assert metadata["with"]["alert-lookup"] is True
+    assert metadata["with"]["github-token"] == (
+        "${{ secrets.DEPENDABOT_APPROVAL_TOKEN }}"
+    )
+
+
+def test_approval_is_bound_to_the_current_head_and_dedicated_token() -> None:
+    steps = _workflow()["jobs"]["dependabot"]["steps"]
+    approval = next(
+        step for step in steps if step["name"] == "Approve eligible Dependabot PR"
+    )
+
+    assert '-f commit_id="$HEAD_SHA"' in approval["run"]
+    assert approval["env"]["HEAD_SHA"] == "${{ github.event.pull_request.head.sha }}"
+    assert approval["env"]["GH_TOKEN"] == ("${{ secrets.DEPENDABOT_APPROVAL_TOKEN }}")
+
+
+def test_approval_and_auto_merge_share_security_aware_eligibility() -> None:
+    steps = _workflow()["jobs"]["dependabot"]["steps"]
+    metadata = next(step for step in steps if step.get("id") == "metadata")
+    approval = next(
+        step for step in steps if step["name"] == "Approve eligible Dependabot PR"
+    )
+    auto_merge = next(
+        step for step in steps if step["name"] == "Enable auto-merge for Dependabot PRs"
+    )
+
+    assert steps.index(metadata) < steps.index(approval)
+    assert steps.index(metadata) < steps.index(auto_merge)
+    expected = (
+        "${{ (steps.metadata.outputs.alert-state == 'OPEN' && "
+        "!contains(steps.metadata.outputs.dependency-names, ',')) || "
+        'contains(fromJson(\'["version-update:semver-minor",'
+        '"version-update:semver-patch"]\'), '
+        "steps.metadata.outputs.update-type) }}"
+    )
+    assert {_normalize(approval["if"]), _normalize(auto_merge["if"])} == {
+        _normalize(expected)
+    }