From df130e35f5e521986e533c029a5efa50297e583e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 20 Oct 2026 11:18:29 +0000 Subject: [PATCH 1/3] ci: auto-merge Dependabot patch and minor updates with merge-capable token Co-authored-by: hassieb.pakzad --- .github/workflows/dependabot-merge.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml index 8e5040e77..41cd76314 100644 --- a/.github/workflows/dependabot-merge.yml +++ b/.github/workflows/dependabot-merge.yml @@ -4,23 +4,27 @@ on: pull_request: branches: [main] -permissions: - contents: write - pull-requests: write +permissions: {} jobs: dependabot: runs-on: ubuntu-latest if: github.event.pull_request.user.id == 49699333 # dependabot[bot] + permissions: + contents: read + pull-requests: read steps: - name: Dependabot metadata id: metadata uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" + # GITHUB_TOKEN is not allowed to push to the protected main branch, so + # enabling auto-merge requires a token whose user may merge into main. + # Majors stay manual. - name: Enable auto-merge for Dependabot PRs - if: ${{steps.metadata.outputs.update-type == 'version-update:semver-patch'}} + if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' }} run: gh pr merge --auto --squash "$PR_URL" env: - PR_URL: ${{github.event.pull_request.html_url}} - GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} + PR_URL: ${{ github.event.pull_request.html_url }} + GITHUB_TOKEN: ${{ secrets.GH_TOKEN_DEPENDABOT_JS_PY }} From 5f73ded3365a45bd81c390a4853c55ca157edbce Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 20 Oct 2026 14:26:19 +0000 Subject: [PATCH 2/3] ci: keep 0.x minor Dependabot bumps on manual review Co-authored-by: hassieb.pakzad --- .github/workflows/dependabot-merge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml index 41cd76314..ef89a5f49 100644 --- a/.github/workflows/dependabot-merge.yml +++ b/.github/workflows/dependabot-merge.yml @@ -21,9 +21,9 @@ jobs: github-token: "${{ secrets.GITHUB_TOKEN }}" # GITHUB_TOKEN is not allowed to push to the protected main branch, so # enabling auto-merge requires a token whose user may merge into main. - # Majors stay manual. + # Majors stay manual, and so do 0.x minor bumps (breaking under semver). - name: Enable auto-merge for Dependabot PRs - if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' }} + if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' || (steps.metadata.outputs.update-type == 'version-update:semver-minor' && !startsWith(steps.metadata.outputs.previous-version, '0.')) }} run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} From 3a192539d61231ae4c1619a5e9f77f60259c4af6 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Tue, 20 Oct 2026 14:32:15 +0000 Subject: [PATCH 3/3] ci: decide Dependabot auto-merge per updated dependency Co-authored-by: hassieb.pakzad --- .github/workflows/dependabot-merge.yml | 40 ++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dependabot-merge.yml b/.github/workflows/dependabot-merge.yml index ef89a5f49..79055d446 100644 --- a/.github/workflows/dependabot-merge.yml +++ b/.github/workflows/dependabot-merge.yml @@ -19,12 +19,40 @@ jobs: uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - # GITHUB_TOKEN is not allowed to push to the protected main branch, so - # enabling auto-merge requires a token whose user may merge into main. - # Majors stay manual, and so do 0.x minor bumps (breaking under semver). - - name: Enable auto-merge for Dependabot PRs - if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' || (steps.metadata.outputs.update-type == 'version-update:semver-minor' && !startsWith(steps.metadata.outputs.previous-version, '0.')) }} + # Every updated dependency must be a patch, or a minor that is not a 0.x + # bump (0.x minors may break). Checked per dependency because grouped + # PRs report previous-version only for their first dependency. + - name: Decide whether to auto-merge + id: decide + env: + UPDATED_DEPENDENCIES: ${{ steps.metadata.outputs.updated-dependencies-json }} + run: | + if jq -e ' + length > 0 and all(.[]; + .updateType == "version-update:semver-patch" or + (.updateType == "version-update:semver-minor" and + ((.prevVersion // "") | test("^v?0\\.") | not))) + ' <<<"$UPDATED_DEPENDENCIES" >/dev/null; then + echo "auto-merge=true" >> "$GITHUB_OUTPUT" + else + echo "auto-merge=false" >> "$GITHUB_OUTPUT" + fi + # Uses a PAT because main restricts pushes, so GITHUB_TOKEN cannot enable + # auto-merge; the PAT-authored merge also triggers push workflows on main. + - name: Enable auto-merge + if: steps.decide.outputs.auto-merge == 'true' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} - GITHUB_TOKEN: ${{ secrets.GH_TOKEN_DEPENDABOT_JS_PY }} + GH_TOKEN: ${{ secrets.GH_TOKEN_DEPENDABOT_JS_PY }} + # Auto-merge persists across pushes, so a grouped PR that gains a manual + # update after auto-merge was enabled must have it turned off again. + - name: Disable auto-merge + if: steps.decide.outputs.auto-merge != 'true' + run: | + if [ "$(gh pr view "$PR_URL" --json autoMergeRequest --jq '.autoMergeRequest != null')" = "true" ]; then + gh pr merge --disable-auto "$PR_URL" + fi + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GH_TOKEN_DEPENDABOT_JS_PY }}