Update dependency devise to v5 [SECURITY] #1344
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto approve & merge Dependabot and Renovate PRs | |
| on: | |
| pull_request: | |
| types: [opened, edited, synchronize, reopened, labeled] | |
| branches: [master] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| checks: read | |
| statuses: read | |
| concurrency: | |
| group: auto-merge-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| auto-approve-merge: | |
| if: github.repository == 'internetee/registry' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Install GitHub CLI | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y gh | |
| - name: Auto approve PR | |
| if: | | |
| github.event.pull_request.user.login == 'dependabot[bot]' || | |
| github.event.pull_request.user.login == 'renovate[bot]' | |
| uses: hmarr/auto-approve-action@v3 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Fetch Dependabot metadata | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v1 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Check if PR should be auto-merged | |
| id: check_auto_merge | |
| run: | | |
| PR_AUTHOR="${{ github.event.pull_request.user.login }}" | |
| UPDATE_TYPE="${{ steps.metadata.outputs.update-type || 'unknown' }}" | |
| if [ "$PR_AUTHOR" == "dependabot[bot]" ]; then | |
| if [[ "$UPDATE_TYPE" == "version-update:semver-patch" || "$UPDATE_TYPE" == "version-update:semver-minor" ]]; then | |
| echo "auto_merge=true" >> $GITHUB_OUTPUT | |
| echo "update_type=${UPDATE_TYPE}" >> $GITHUB_OUTPUT | |
| echo "Auto-merge: Dependabot patch or minor update detected" | |
| else | |
| echo "auto_merge=false" >> $GITHUB_OUTPUT | |
| echo "update_type=${UPDATE_TYPE}" >> $GITHUB_OUTPUT | |
| echo "Auto-merge: Dependabot major or non-semver update, skipping" | |
| fi | |
| elif [ "$PR_AUTHOR" == "renovate[bot]" ]; then | |
| LABELS=$(gh pr view ${{ github.event.pull_request.number }} --json labels -q '.labels[].name' | tr '\n' ' ') | |
| if [[ "$LABELS" != *"major"* ]] && ( [[ "$LABELS" == *"patch"* ]] || [[ "$LABELS" == *"minor"* ]] ); then | |
| echo "auto_merge=true" >> $GITHUB_OUTPUT | |
| echo "update_type=renovate-patch-or-minor" >> $GITHUB_OUTPUT | |
| else | |
| echo "auto_merge=false" >> $GITHUB_OUTPUT | |
| echo "update_type=renovate-major-or-unlabeled" >> $GITHUB_OUTPUT | |
| fi | |
| else | |
| echo "auto_merge=false" >> $GITHUB_OUTPUT | |
| echo "update_type=${UPDATE_TYPE}" >> $GITHUB_OUTPUT | |
| echo "Auto-merge: Unknown author ${PR_AUTHOR}, skipping" | |
| fi | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| shell: bash | |
| - name: Wait for lockfile sync | |
| if: steps.check_auto_merge.outputs.auto_merge == 'true' | |
| uses: lewagon/wait-on-check-action@v1.9.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| wait-interval: 15 | |
| running-workflow-name: Auto approve & merge Dependabot and Renovate PRs | |
| ignore-checks: auto-approve-merge,Summary | |
| check-name: sync-lockfile | |
| fail-on-no-checks: false | |
| allowed-conclusions: success,skipped,cancelled | |
| checks-discovery-timeout: 180 | |
| - name: Resolve latest PR SHA | |
| if: steps.check_auto_merge.outputs.auto_merge == 'true' | |
| id: head | |
| run: | | |
| SHA=$(gh pr view "${{ github.event.pull_request.number }}" --json headRefOid -q .headRefOid) | |
| echo "sha=$SHA" >> "$GITHUB_OUTPUT" | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| shell: bash | |
| - name: Wait for CI checks | |
| if: steps.check_auto_merge.outputs.auto_merge == 'true' | |
| uses: lewagon/wait-on-check-action@v1.9.1 | |
| with: | |
| ref: ${{ steps.head.outputs.sha }} | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| wait-interval: 30 | |
| running-workflow-name: Auto approve & merge Dependabot and Renovate PRs | |
| ignore-checks: auto-approve-merge,Summary,sync-lockfile | |
| check-regexp: '^test' | |
| allowed-conclusions: success,skipped | |
| checks-discovery-timeout: 300 | |
| - name: Check CI status | |
| if: steps.check_auto_merge.outputs.auto_merge == 'true' | |
| id: ci_status | |
| run: | | |
| PR_NUMBER='${{ github.event.pull_request.number }}' | |
| NON_SUCCESS=$(gh pr checks "$PR_NUMBER" --required --json name,state -q '.[] | select(.state != "SUCCESS") | "\(.name):\(.state)"' || true) | |
| if [ -z "$NON_SUCCESS" ]; then | |
| echo "ci_passed=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "ci_passed=false" >> $GITHUB_OUTPUT | |
| echo "CI checks failed or pending, skipping auto-merge" | |
| echo "$NON_SUCCESS" | |
| exit 1 | |
| fi | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Auto-merge PR | |
| if: steps.check_auto_merge.outputs.auto_merge == 'true' && steps.ci_status.outputs.ci_passed == 'true' | |
| run: | | |
| PR_NUMBER='${{ github.event.pull_request.number }}' | |
| if gh pr merge --merge "$PR_NUMBER"; then | |
| echo "Merged PR #$PR_NUMBER" | |
| exit 0 | |
| fi | |
| STATE=$(gh pr view "$PR_NUMBER" --json state -q .state) | |
| if [ "$STATE" = "MERGED" ]; then | |
| echo "PR #$PR_NUMBER was already merged" | |
| exit 0 | |
| fi | |
| gh pr merge --auto --merge "$PR_NUMBER" | |
| STATE=$(gh pr view "$PR_NUMBER" --json state -q .state) | |
| if [ "$STATE" = "MERGED" ]; then | |
| echo "Merged PR #$PR_NUMBER via auto-merge" | |
| exit 0 | |
| fi | |
| echo "Failed to merge PR #$PR_NUMBER (state=$STATE)" >&2 | |
| exit 1 | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |