mirror of
https://github.com/yeasy/docker_practice.git
synced 2026-08-10 08:27:25 +00:00
yeasy
4175760d1b
Neither step did what its name said, and together they meant no Dependabot PR was ever auto-merged — the job died before reaching the merge step. 1. "Confirm required checks are configured" failed OPEN. It read branch protection, which GITHUB_TOKEN cannot do (administration scope is not even a valid permissions key), so gh api returned 403 JSON into REQUIRED and `[ "$REQUIRED" -eq 0 ]` died with "integer expression expected". A failing test inside an `if` condition is exempt from set -e, so the guard evaluated false and let execution continue. A guard whose whole purpose is refusing an unsafe merge silently passed whenever it could not check. 2. "Approve low-risk Dependabot PR" can never succeed: GitHub Actions is not permitted to approve pull requests. It is also unnecessary — these repos do not require reviews. The real gate is now branch protection, which as of today requires BOTH check-commit-identity and CI on every repo, and gh pr merge --auto cannot complete until they pass. That is stronger than the removed probe, which only checked that some required check existed. This makes the 13 repos match oc_guide, which already had exactly this shape and was the only one whose auto-merge was not broken. prompt_engineering_guide asserted the old step ORDER; its test now asserts the invariants that still hold — no self-approve attempt, and auto-merge gated on the low-risk update-type allowlist.
30 lines
931 B
Go
30 lines
931 B
Go
name: Dependabot auto-merge
|
|
on: pull_request
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
dependabot:
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
checks: read
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
if: github.actor == 'dependabot[bot]'
|
|
steps:
|
|
- name: Dependabot metadata
|
|
id: metadata
|
|
uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
|
|
with:
|
|
github-token: "${{ secrets.GITHUB_TOKEN }}"
|
|
|
|
- name: Enable auto-merge for low-risk Dependabot PRs
|
|
if: >
|
|
steps.metadata.outputs.package-ecosystem == 'github_actions' &&
|
|
contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
|
|
run: gh pr merge --auto --merge "$PR_URL"
|
|
env:
|
|
PR_URL: ${{github.event.pull_request.html_url}}
|
|
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
|