From 0ff1a8c0738ac1292aa02622bc7a19c70d1cca2d Mon Sep 17 00:00:00 2001 From: Bigessfour Date: Mon, 27 Jul 2026 14:05:24 -0600 Subject: [PATCH] chore(deps): Dependabot hygiene for majors and auto-merge Ignore SkiaSharp/HarfBuzz major natives (Syncfusion-coupled). Add npm ecosystem for root tooling. Fix auto-merge so GITHUB_TOKEN no longer fails on PR approve (0 required reviews; enable squash auto-merge only). --- .github/dependabot.yml | 29 +++++++++++++++++++++ .github/workflows/dependabot-auto-merge.yml | 19 +++++--------- docs/dependabot-policy.md | 7 ++--- 3 files changed, 40 insertions(+), 15 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index eac4823..e5d8730 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,6 +24,7 @@ updates: patterns: - "*" ignore: + # Test harness majors deferred (see docs/dependabot-policy.md) - dependency-name: bunit update-types: - version-update:semver-major @@ -33,6 +34,13 @@ updates: - dependency-name: Microsoft.NET.Test.Sdk update-types: - version-update:semver-major + # Syncfusion DocIO/XlsIO PDF render natives — majors need coordinated smoke on NAS/Docker + - dependency-name: SkiaSharp.NativeAssets.Linux + update-types: + - version-update:semver-major + - dependency-name: HarfBuzzSharp.NativeAssets.Linux + update-types: + - version-update:semver-major - package-ecosystem: github-actions directory: / @@ -57,3 +65,24 @@ updates: applies-to: security-updates patterns: - "*" + + # Root package-lock is repomix/MCP tooling only (not clerk runtime) + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + day: monday + time: "09:00" # yamllint disable-line rule:quoted-strings + timezone: America/Denver + open-pull-requests-limit: 3 + labels: + - dependencies + - javascript + groups: + npm-patch-minor: + applies-to: version-updates + update-types: + - patch + - minor + patterns: + - "*" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 71533f7..b18f099 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -1,5 +1,9 @@ -# Approves and auto-merges Dependabot patch/minor PRs after required checks pass. +# Enables auto-merge for Dependabot patch/minor PRs after required checks pass. # Job skips instantly for non-Dependabot PRs (no follow-on workflows). +# +# Note: GITHUB_TOKEN cannot approve PRs unless the repo setting +# "Allow GitHub Actions to create and approve pull requests" is enabled. +# Approving is optional here (main requires 0 reviews); we only enable auto-merge. name: Dependabot auto-merge on: @@ -11,7 +15,7 @@ on: permissions: pull-requests: write - contents: read + contents: write concurrency: group: dependabot-auto-merge-${{ github.event.pull_request.number }} @@ -28,20 +32,11 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" - - name: Approve patch/minor version updates - if: | - steps.metadata.outputs.update-type == 'version-update:semver-patch' || - steps.metadata.outputs.update-type == 'version-update:semver-minor' - run: gh pr review --approve "$PR_URL" - env: - PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Enable auto-merge for patch/minor if: | steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' - run: gh pr merge --auto --merge "$PR_URL" + run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/docs/dependabot-policy.md b/docs/dependabot-policy.md index 6e3407c..b1b337c 100644 --- a/docs/dependabot-policy.md +++ b/docs/dependabot-policy.md @@ -6,7 +6,7 @@ How TIKR handles dependency update pull requests. Config: [`.github/dependabot.y - **Security updates** take priority over routine version bumps. - **Reduce PR noise** via grouped patch/minor updates and `open-pull-requests-limit`. -- **Never merge** a Dependabot PR with failing required checks (`build-and-test`, `trunk_check`). +- **Never merge** a Dependabot PR with failing required checks (`build-and-test`, `trunk-check`). - **Major upgrades** require manual review; some test-stack majors are deferred (see ignore rules in config). ## Merge tiers @@ -17,11 +17,12 @@ How TIKR handles dependency update pull requests. Config: [`.github/dependabot.y | Patch / minor | NuGet, GitHub Actions | **Auto-merge** when required checks pass | | Major | NuGet (general) | Manual review + `dotnet test`; owner merges | | Major | `bunit`, `coverlet.collector`, `Microsoft.NET.Test.Sdk` | **Deferred** until Phase 7 test harness work — ignored in config | +| Major | `SkiaSharp.NativeAssets.Linux`, `HarfBuzzSharp.NativeAssets.Linux` | **Deferred** — Syncfusion DocIO/XlsIO PDF natives; coordinate with renderer smoke — ignored in config | ## Required CI (non-negotiable) - **TIKR CI** — `build-and-test` (restore, build, test, Docker smoke optional) -- **Trunk** — `trunk_check` (gitleaks, yaml/md/docker lint, dotnet format verify) +- **Trunk** — `trunk-check` (gitleaks, yaml/md/docker lint, dotnet format verify) ## Weekly rhythm @@ -39,7 +40,7 @@ If `main` moved or CI was broken when a PR opened: ### Never do -- Merge with red `build-and-test` or `trunk_check`. +- Merge with red `build-and-test` or `trunk-check`. - Auto-merge **major** version updates. - Auto-merge **security** PRs without review (manual merge preferred).