Repository navigation
Bump the major-deps-updates group across 1 directory with 7 updates #1126
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # this workflow merges requests from Dependabot if tests are passing | ||
|
Check warning on line 1 in .github/workflows/update.yml
|
||
| # ref https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions | ||
| # and https://github.com/dependabot/fetch-metadata | ||
| name: Auto-merge | ||
| # `pull_request_target` means this uses code in the base branch, not the PR. | ||
| on: pull_request_target | ||
| # Dependabot PRs' tokens have read permissions by default and thus we must enable write permissions. | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| jobs: | ||
| dependencies: | ||
| runs-on: ubuntu-latest | ||
| if: github.actor == 'dependabot[bot]' | ||
| steps: | ||
| - name: Fetch PR metadata | ||
| id: metadata | ||
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Wait for PR CI | ||
| # npm minor and patch only (GitHub Actions updates stay manual); update-type is the highest update of a group, and empty when unknown | ||
| if: >- | ||
| contains(steps.metadata.outputs.package-ecosystem, 'npm') && | ||
| contains(fromJSON('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type) | ||
| uses: lewagon/wait-on-check-action@369769072fe522a3a8a85c03c96af1e5242a1994 # v1.9.1 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| repo-token: ${{ secrets.GITHUB_TOKEN }} | ||
| wait-interval: 30 # seconds | ||
| running-workflow-name: dependencies # wait for all checks except this one | ||
| # CodeQL default setup does not scan Dependabot PRs, so its PR check ends neutral; an alert still ends as failure. | ||
| # Skipped or cancelled is not sufficient. | ||
| allowed-conclusions: success,neutral | ||
| - name: Auto-merge dependabot PRs | ||
| # npm minor and patch only (GitHub Actions updates stay manual); update-type is the highest update of a group, and empty when unknown | ||
| if: >- | ||
| contains(steps.metadata.outputs.package-ecosystem, 'npm') && | ||
| contains(fromJSON('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type) | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| # The "auto" flag will only merge once all of the target branch's required checks | ||
| # are met. Configure those in the "branch protection" settings for each repo. | ||
| run: gh pr merge --auto --squash "$PR_URL" | ||
