chore(deps-dev): bump globals from 16.5.0 to 17.9.0 #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # Enables auto-merge on Dependabot's patch and minor updates. GitHub then merges | |
| # them once the branch protection checks pass — a red build never lands. | |
| # | |
| # Major bumps are deliberately excluded: they are the ones that break builds, and | |
| # they stay open for a human to read. | |
| # | |
| # No step approves anything. Keysoft branch protection requires both green checks | |
| # and a human approval, so this workflow only queues an eligible update for merge; | |
| # it cannot bypass review. A bot approving its own dependency bump would not be | |
| # meaningful oversight. | |
| # | |
| # Why pull_request_target and not pull_request: GitHub treats Dependabot runs as if | |
| # they came from a fork, so on `pull_request` the GITHUB_TOKEN is read-only and | |
| # cannot enable auto-merge. `pull_request_target` runs in the base repository's | |
| # context with a writable token. That trigger is dangerous when a workflow checks | |
| # out and runs the pull request's code, because untrusted code would inherit those | |
| # permissions — this workflow never checks out the PR, it only reads metadata and | |
| # calls the API. | |
| on: pull_request_target | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| # Check the author rather than the actor, so the job cannot be driven by a | |
| # pull request someone else opened. | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: meta | |
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 | |
| - name: Enable auto-merge for patch and minor updates | |
| if: | | |
| steps.meta.outputs.update-type == 'version-update:semver-patch' || | |
| steps.meta.outputs.update-type == 'version-update:semver-minor' | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Leave major updates for manual review | |
| if: steps.meta.outputs.update-type == 'version-update:semver-major' | |
| run: | | |
| echo "::notice::Major update (${{ steps.meta.outputs.dependency-names }}) left for manual review." |