diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..0d9c923 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,25 @@ +version: 2 +updates: + # Enable version updates for npm + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + # Allow both direct and indirect updates + allow: + - dependency-type: "all" + # Automatically rebase PRs when conflicts occur + rebase-strategy: "auto" + # Group minor and patch updates together + groups: + minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + # Set commit message preferences + commit-message: + prefix: "chore" + prefix-development: "chore" + include: "scope" \ No newline at end of file diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml new file mode 100644 index 0000000..e658506 --- /dev/null +++ b/.github/workflows/dependabot-automerge.yml @@ -0,0 +1,48 @@ +name: TA2MAi Auto-merge + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: write + pull-requests: write + checks: read + +jobs: + dependabot-automerge: + runs-on: ubuntu-latest + if: github.actor == 'TA2MA-bot[bot]' + steps: + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v1.6.0 + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" + + - name: Wait for status checks + uses: lewagon/wait-on-check-action@v1.3.1 + with: + ref: ${{ github.event.pull_request.head.sha }} + check-name: 'build' # This matches the job name in proof-html.yml + repo-token: ${{ secrets.GITHUB_TOKEN }} + wait-interval: 10 + + - name: Enable auto-merge for patch and minor updates + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: gh pr merge --auto --merge "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Comment on major version updates + if: steps.metadata.outputs.update-type == 'version-update:semver-major' + run: | + gh pr comment "$PR_URL" --body "🚨 **Major version update detected!** + + This PR contains a major version update that may include breaking changes. Please review manually before merging. + + If you're confident this update is safe, you can merge it manually or uncomment the auto-merge line in the workflow." + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}