ehlxr/docker_practice
1
0
Fork 0
mirror of https://github.com/yeasy/docker_practice.git synced 2026-08-10 08:27:25 +00:00
Code Issues Projects Releases Wiki Activity

ci: drop the two Dependabot auto-merge steps that could never work

Browse Source 
Neither step did what its name said, and together they meant no Dependabot PR
was ever auto-merged — the job died before reaching the merge step.

1. "Confirm required checks are configured" failed OPEN. It read branch
   protection, which GITHUB_TOKEN cannot do (administration scope is not even
   a valid permissions key), so gh api returned 403 JSON into REQUIRED and
   `[ "$REQUIRED" -eq 0 ]` died with "integer expression expected". A failing
   test inside an `if` condition is exempt from set -e, so the guard evaluated
   false and let execution continue. A guard whose whole purpose is refusing
   an unsafe merge silently passed whenever it could not check.

2. "Approve low-risk Dependabot PR" can never succeed: GitHub Actions is not
   permitted to approve pull requests. It is also unnecessary — these repos do
   not require reviews.

The real gate is now branch protection, which as of today requires BOTH
check-commit-identity and CI on every repo, and gh pr merge --auto cannot
complete until they pass. That is stronger than the removed probe, which only
checked that some required check existed.

This makes the 13 repos match oc_guide, which already had exactly this shape
and was the only one whose auto-merge was not broken.

prompt_engineering_guide asserted the old step ORDER; its test now asserts the
invariants that still hold — no self-approve attempt, and auto-merge gated on
the low-risk update-type allowlist.
This commit is contained in:
yeasy
2026-07-23 17:27:39 -07:00
parent b7d4410cf0
commit 4175760d1b
1 changed files with 0 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/dependabot-automerge.yml
-22
View File
@@ -19,28 +19,6 @@ jobs:
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Confirm required checks are configured
if: >
steps.metadata.outputs.package-ecosystem == 'github_actions' &&
contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
run: |
REQUIRED=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${{ github.event.pull_request.base.ref }}/protection/required_status_checks" --jq '((.contexts // []) | length) + ((.checks // []) | length)' 2>/dev/null || echo 0)
if [ "$REQUIRED" -eq 0 ]; then
echo "No required status checks configured on the base branch; refusing Dependabot auto-merge."
exit 1
fi
env:
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
- name: Approve low-risk Dependabot PR
if: >
steps.metadata.outputs.package-ecosystem == 'github_actions' &&
contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
run: gh pr review --approve "$PR_URL"
env:
PR_URL: ${{github.event.pull_request.html_url}}
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
- name: Enable auto-merge for low-risk Dependabot PRs
if: >
steps.metadata.outputs.package-ecosystem == 'github_actions' &&