ci: auto-merge Dependabot minor and patch updates, allow the CodeQL neutral check (#525)

* ci: auto-merge Dependabot minor and patch updates, allow the CodeQL neutral check

CodeQL default setup does not scan Dependabot PRs, so its check ends
neutral and the gate failed on every Dependabot PR. Major updates are
no longer merged automatically.

* ci: say that GitHub Actions updates stay manual

Author: plum117

.github/workflows/update.yml

@@ -24,21 +24,25 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Wait for PR CI
-        # Don't merge updates to GitHub Actions versions automatically.
-        # (Some repos may wish to limit by version range (major/minor/patch), or scope (dep vs dev-dep), too.)
-        if: contains(steps.metadata.outputs.package-ecosystem, 'npm')
+        # npm minor and patch only (GitHub Actions updates stay manual); update-type is the highest update of a group, and empty when unknown
+        if: >-
+          contains(steps.metadata.outputs.package-ecosystem, 'npm') &&
+          contains(fromJSON('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type)
         uses: lewagon/wait-on-check-action@369769072fe522a3a8a85c03c96af1e5242a1994 # v1.9.1
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           wait-interval: 30 # seconds
           running-workflow-name: dependencies # wait for all checks except this one
-          allowed-conclusions: success # all other checks must pass, being skipped or cancelled is not sufficient
+          # CodeQL default setup does not scan Dependabot PRs, so its PR check ends neutral; an alert still ends as failure.
+          # Skipped or cancelled is not sufficient.
+          allowed-conclusions: success,neutral
 
       - name: Auto-merge dependabot PRs
-        # Don't merge updates to GitHub Actions versions automatically.
-        # (Some repos may wish to limit by version range (major/minor/patch), or scope (dep vs dev-dep), too.)
-        if: contains(steps.metadata.outputs.package-ecosystem, 'npm')
+        # npm minor and patch only (GitHub Actions updates stay manual); update-type is the highest update of a group, and empty when unknown
+        if: >-
+          contains(steps.metadata.outputs.package-ecosystem, 'npm') &&
+          contains(fromJSON('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type)
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}