chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # Enables auto-merge on Dependabot's patch and minor updates. GitHub then merges | |
| # them once the branch protection checks pass — a red build never lands. | |
| # | |
| # Major bumps are deliberately excluded: they are the ones that break builds, and | |
| # they stay open for a human to read. | |
| # | |
| # No step approves anything. The branch protection on these repositories requires | |
| # passing status checks but not an approving review, so auto-merge is satisfied by | |
| # a green CI alone. That is the point: GitHub documents restricting workflows from | |
| # approving pull requests as a security best practice, and a bot approving its own | |
| # dependency bumps would be oversight in name only. | |
| # | |
| # Why pull_request_target and not pull_request: GitHub treats Dependabot runs as if | |
| # they came from a fork, so on `pull_request` the GITHUB_TOKEN is read-only and | |
| # cannot enable auto-merge. `pull_request_target` runs in the base repository's | |
| # context with a writable token. That trigger is dangerous when a workflow checks | |
| # out and runs the pull request's code, because untrusted code would inherit those | |
| # permissions — this workflow never checks out the PR, it only reads metadata and | |
| # calls the API. | |
| on: pull_request_target | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| # Check the author rather than the actor, so the job cannot be driven by a | |
| # pull request someone else opened. | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: meta | |
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 | |
| - name: Enable auto-merge for patch and minor updates | |
| if: | | |
| steps.meta.outputs.update-type == 'version-update:semver-patch' || | |
| steps.meta.outputs.update-type == 'version-update:semver-minor' | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Leave major updates for manual review | |
| if: steps.meta.outputs.update-type == 'version-update:semver-major' | |
| run: | | |
| echo "::notice::Major update (${{ steps.meta.outputs.dependency-names }}) left for manual review." |