From 52fa262802e59ed199e5756d7ac462b2cfd7167c Mon Sep 17 00:00:00 2001 From: Matthias Endler Date: Thu, 29 Oct 2026 12:28:36 +0100 Subject: [PATCH 1/2] Group Dependabot updates and merge after CI passes --- .github/DEPENDABOT.md | 27 +++++++++++++++++++++++ .github/dependabot.yml | 24 ++++++++++++++++++-- .github/workflows/auto-merge.yml | 13 ----------- .github/workflows/ci.yml | 38 ++++++++++++++++++++++++++++++++ 4 files changed, 87 insertions(+), 15 deletions(-) create mode 100644 .github/DEPENDABOT.md delete mode 100644 .github/workflows/auto-merge.yml diff --git a/.github/DEPENDABOT.md b/.github/DEPENDABOT.md new file mode 100644 index 000000000..44ec955f7 --- /dev/null +++ b/.github/DEPENDABOT.md @@ -0,0 +1,27 @@ +# Dependency updates + +Dependabot checks for routine Cargo and GitHub Actions updates every Monday at +11:00 UTC. Minor and patch updates are grouped by ecosystem. Security updates +have separate groups and aren't held for the weekly version-update schedule. +Major updates stay separate and require a manual merge. + +The `dependabot-merge` job in `ci.yml` runs only after both CI jobs succeed: +`readme-check` and `render` (formatting, Clippy, tests, and rendering). It verifies +Dependabot's metadata, including the highest update type in a group, then +squash-merges minor and patch updates. It checks that the PR head hasn't changed +since that CI run. The merge job never checks out or executes PR code. + +This uses the existing `AUTOMERGE_TOKEN` Dependabot secret. The token needs +permission to merge PRs, including PRs that update workflow files. If it expires, +replace it under **Settings → Secrets and variables → Dependabot**. Don't replace +it with `GITHUB_TOKEN`: merges made with that token won't trigger the subsequent +push workflow. + +After a merge, the existing `Render` GitHub Actions workflow regenerates the +list, commits generated changes, and sends a `rebuild` event to the separate +`analysis-tools-dev/website-next` repository. Website hosting is unchanged. + +No GitHub App, branch ruleset, or native **Allow auto-merge** setting is needed. +CI gates these automated dependency merges; it doesn't enforce checks on human +merges. If branch protection is added later, account for the list-generation +workflow's direct pushes to `master` before enabling it. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2be0e9054..9d6edda2f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,12 +3,32 @@ updates: - package-ecosystem: cargo directory: "/ci" schedule: - interval: daily + interval: weekly + day: monday time: "11:00" open-pull-requests-limit: 10 + groups: + cargo-minor-patch: + applies-to: version-updates + patterns: ["*"] + update-types: [minor, patch] + cargo-security: + applies-to: security-updates + patterns: ["*"] + update-types: [minor, patch] - package-ecosystem: github-actions directory: "/" schedule: - interval: daily + interval: weekly + day: monday time: "11:00" open-pull-requests-limit: 10 + groups: + actions-minor-patch: + applies-to: version-updates + patterns: ["*"] + update-types: [minor, patch] + actions-security: + applies-to: security-updates + patterns: ["*"] + update-types: [minor, patch] diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml deleted file mode 100644 index 8bf9ccd23..000000000 --- a/.github/workflows/auto-merge.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: auto-merge - -on: - pull_request: - -jobs: - auto-merge: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - uses: ahmadnassri/action-dependabot-auto-merge@v2 - with: - github-token: ${{ secrets.AUTOMERGE_TOKEN }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ec5063075..d82825e17 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -94,3 +94,41 @@ jobs: gh api "repos/$REPO/issues/$PR/comments" \ -f body=@/tmp/render-comment.txt \ --silent + + dependabot-merge: + needs: [readme-check, render] + if: >- + github.actor == 'dependabot[bot]' && + github.event.pull_request.user.login == 'dependabot[bot]' && + github.event.pull_request.head.repo.full_name == github.repository && + !github.event.pull_request.draft + runs-on: ubuntu-latest + timeout-minutes: 5 + permissions: + contents: read + pull-requests: read + steps: + # Keep the merge credential isolated from the jobs that execute PR code. + - name: Verify Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + + - name: Merge minor and patch updates after CI passes + if: >- + (steps.metadata.outputs.package-ecosystem == 'cargo' || + steps.metadata.outputs.package-ecosystem == 'github_actions') && + (steps.metadata.outputs.update-type == 'version-update:semver-minor' || + steps.metadata.outputs.update-type == 'version-update:semver-patch') + env: + # Use the existing Dependabot secret so the merge triggers the + # list-generation workflow and its website rebuild event. + GH_TOKEN: ${{ secrets.AUTOMERGE_TOKEN }} + PR_URL: ${{ github.event.pull_request.html_url }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + if [ -z "$GH_TOKEN" ]; then + echo "::error::Set the AUTOMERGE_TOKEN Dependabot secret." + exit 1 + fi + + gh pr merge "$PR_URL" --squash --match-head-commit "$HEAD_SHA" From b62320f801afe239a35e293a550039f32aa38003 Mon Sep 17 00:00:00 2001 From: Matthias Endler Date: Thu, 29 Oct 2026 12:43:52 +0100 Subject: [PATCH 2/2] Delete .github/DEPENDABOT.md --- .github/DEPENDABOT.md | 27 --------------------------- 1 file changed, 27 deletions(-) delete mode 100644 .github/DEPENDABOT.md diff --git a/.github/DEPENDABOT.md b/.github/DEPENDABOT.md deleted file mode 100644 index 44ec955f7..000000000 --- a/.github/DEPENDABOT.md +++ /dev/null @@ -1,27 +0,0 @@ -# Dependency updates - -Dependabot checks for routine Cargo and GitHub Actions updates every Monday at -11:00 UTC. Minor and patch updates are grouped by ecosystem. Security updates -have separate groups and aren't held for the weekly version-update schedule. -Major updates stay separate and require a manual merge. - -The `dependabot-merge` job in `ci.yml` runs only after both CI jobs succeed: -`readme-check` and `render` (formatting, Clippy, tests, and rendering). It verifies -Dependabot's metadata, including the highest update type in a group, then -squash-merges minor and patch updates. It checks that the PR head hasn't changed -since that CI run. The merge job never checks out or executes PR code. - -This uses the existing `AUTOMERGE_TOKEN` Dependabot secret. The token needs -permission to merge PRs, including PRs that update workflow files. If it expires, -replace it under **Settings → Secrets and variables → Dependabot**. Don't replace -it with `GITHUB_TOKEN`: merges made with that token won't trigger the subsequent -push workflow. - -After a merge, the existing `Render` GitHub Actions workflow regenerates the -list, commits generated changes, and sends a `rebuild` event to the separate -`analysis-tools-dev/website-next` repository. Website hosting is unchanged. - -No GitHub App, branch ruleset, or native **Allow auto-merge** setting is needed. -CI gates these automated dependency merges; it doesn't enforce checks on human -merges. If branch protection is added later, account for the list-generation -workflow's direct pushes to `master` before enabling it.