ci: migrate Biome configuration on Dependabot Biome updates

[edbfi]

What

Adds .github/workflows/biome-migrate.yml, a byte-identical copy of edbfi-ci's templates/biome-migrate.yml (D4 layer 3, S15). On a Dependabot PR that changes @biomejs/biome:

• migrate runs biome migrate --write, unprivileged.
• apply pushes one chore(deps): apply biome migrate [dependabot skip] commit, if the patch touches only biome.json/biome.jsonc, using BIOME_MIGRATE_TOKEN.
• enable turns on auto-merge for the new head.

Pilot evidence

End-to-end in edbfi/edbfi-ci-playground (#14 fixture, Biome 1.9.4 → 2.5.15):

• Dependabot opened chore(deps-dev): bump @biomejs/biome from 1.9.4 to 2.5.15 in the biome group edbfi-ci-playground#15. Its un-migrated head was red (layer-2 biome-migrate hook).
• migrate → apply pushed 7e672d5: one github-actions[bot] commit whose parent is the Dependabot head, changing only biome.json.
• enable turned on auto-merge. The migrated head went green and the PR merged itself.
• On the bot's own commit the workflow skipped, so there's no loop.
• The first attempt hit a 403 because the PAT didn't cover the playground; it passed once the owner added the repository.

edbfi/portaler#126 carries the same file. This repo already has the BIOME_MIGRATE_TOKEN and DEPENDENCY_AUTOMERGE_TOKEN Dependabot secrets.

Gates

• bun install --frozen-lockfile, then prek run --files .github/workflows/biome-migrate.yml (actionlint, zizmor, privileged-jobs): passed.

Owner actions

• None. The owner approved the rollout after the pilot on 2026-10-11.

[pullfrog]

ℹ️ No critical issues and no inline findings; nothing to change.

Reviewed changes

Reviewed the single new file in full at 94308c3.

• migrate job: runs unprivileged (contents: read, persist-credentials: false, bun ci --ignore-scripts). It runs only when package.json has a +/- line mentioning "@biomejs/biome", and it uploads git diff --binary as a one-day artifact keyed by head SHA.
• apply job: downloads that artifact and requires exactly one regular file named biome.patch. It then fetches the head SHA into a fresh repo and applies the patch to the index only, so PR code is never checked out or run. apply --summary must be empty (no create, delete, rename or mode change). Every changed path must be biome.json or biome.jsonc with mode 100644. The job creates a commit on top of HEAD_SHA and pushes it with --force-with-lease=refs/heads/$HEAD_REF:$HEAD_SHA, so a moved head cannot be overwritten. It also re-checks the live PR head before pushing.
• enable job: turns on squash auto-merge pinned with --match-head-commit to the new SHA. It uses the same retry and head-moved logic as the existing dependabot-auto-merge.yml.

I checked the workflow against the repo:

• biome.json exists, @biomejs/biome is 2.5.15, and packageManager is bun@1.4.2. bun-version-file: package.json therefore resolves.
• The actions/checkout and oven-sh/setup-bun SHAs match the ones in ci.yml.
• The biome group in .github/dependabot.yml covers @biomejs/*.
• .pre-commit-config.yaml has the biome-migrate hook that the PR body describes as layer 2.
• Secret use is minimal. BIOME_MIGRATE_TOKEN is exposed only to the push step, DEPENDENCY_AUTOMERGE_TOKEN only to enable, and the top-level permissions: {} is respected.
• The [dependabot skip] commit message and the github.actor == 'dependabot[bot]' gate stop the workflow from looping on its own commit.

I could not run the workflow here, and I could not check the SHA-to-tag mapping for upload-artifact offline. The result rests on reading the code and on the pilot evidence in the PR body.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using claude-sonnet-5-5 ｜ 𝕏}