Repository navigation
Auto-merge green Dependabot updates and group the pm toolchain into one daily PR - #132
Conversation
…ne daily PR Version bumps of @unbrained/pm-cli, pm-ops and pm-changelog are mechanical. Dependabot now checks npm daily and groups the pm toolchain (and other minor/patch updates) into single pull requests; a least-privilege workflow enables squash auto-merge for every non-major Dependabot PR, so it lands as soon as the required checks pass and a failing bump stays open as a defect. pm item: pm-beads-lgqs
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 40 minutes. View limit detailsLimit details: You’ve used the included review currently available. Review configuration: ⚙️ Run configuration
📒 Files selected for processing (5)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (5)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. Summary by CodeRabbit
WalkthroughDependabot now checks npm updates daily and groups toolchain packages separately from other minor and patch updates. A new workflow enables squash auto-merge for eligible Dependabot pull requests. Task records and the changelog document the rollout. ChangesDependabot update automation
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~20 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant Dependabot as Dependabot PR
participant Workflow as Auto-merge workflow
participant Metadata as Dependency metadata
participant GitHub as GitHub PR
Dependabot->>Workflow: Open or update pull request
Workflow->>Metadata: Fetch dependency metadata
Workflow->>GitHub: Enable squash auto-merge when eligible
Merge Risk: ⚪ Minimal · up to Dependabot now opens daily grouped npm updates, and eligible updates merge automatically once the required checks pass. Major updates outside the pm toolchain still wait for a person. No blocking issue remains. Security Architecture ReviewSecurity architecture risk: 🟡 Moderate · up to The workflow limits execution to Dependabot and uses a pinned action, but that action runs with requested repository-write permissions before merge checks finish. Dependency automation can also propose updates to the action itself, creating a pre-merge supply-chain trust path. Required branch protections are asserted but were not independently verified. Retained concerns
Security review detailsSecurity Blast Radius
Security Findings and Attack Paths
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThis PR changes npm Dependabot checks to daily grouped updates and adds a SHA-pinned workflow that enables squash auto-merge for green Dependabot PRs: all non-major updates and the calendar-versioned PM toolchain are eligible, while unrelated major updates remain manual. Repository auto-merge and branch-deletion settings are also required for the behavior described. Flow diagram for Dependabot update grouping and auto-mergeflowchart TD
Schedule[Daily npm Dependabot check] --> Group{Update group}
Group -->|"@unbrained/pm-cli or pm-*"| PM[pm-toolchain PR]
Group -->|Other minor or patch package| Dependencies[dependencies PR]
PM --> Metadata[fetch-metadata]
Dependencies --> Metadata
Metadata --> Eligible{pm-toolchain or non-major}
Eligible -->|Yes| AutoMerge[gh pr merge --auto --squash]
Eligible -->|No| Manual[Manual review required]
AutoMerge --> Checks{Required checks pass}
Checks -->|Yes| Merged[Merged and branch deleted]
Checks -->|No| Open[PR remains open]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
pm item: pm-beads-lgqs
|
@coderabbitai full review |
✅ Action performedFull review finished. |
…sions Review feedback: an update that fetch-metadata cannot classify must not auto-merge, so the condition now requires semver-minor or semver-patch outside the calendar-versioned pm-toolchain group. The job's write scopes are documented, the dependencies group selects every package explicitly, and the item's acceptance criteria name the pm-toolchain exception. pm item: pm-beads-lgqs
|
@coderabbitai full review |
|
1 participant
What
.github/dependabot.yml: npm is checked daily;@unbrained/pm-cliandpm-*packages arrive as onepm-toolchainPR, other minor/patch updates as onedependenciesPR. Other ecosystems are unchanged..github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only inunbraind),dependabot/fetch-metadata(SHA-pinned v3.1.0) classifies the update; thepm-toolchaingroup (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update getgh pr merge --auto --squash. Workflow default permissions are{}; the job alone getscontents: write+pull-requests: write.Why
Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires
test (22),test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.pm item
Summary by Sourcery
Automate the delivery of passing Dependabot updates while preserving required checks and human review for major dependency changes.
New Features:
Enhancements:
Chores:
Summary by cubic
Automates mechanical dependency bumps so green Dependabot PRs merge without a hand-written certification PR.
Dependabot checks npm daily and groups
@unbrained/pm-cliandpm-*packages into onepm-toolchainPR and other minor/patch updates into onedependenciesPR. A least-privilege workflow enables GitHub squash auto-merge as soon as the required checks pass; a failing bump stays open as a defect.pm-toolchainis calendar-versioned, so a year rollover reads as semver-major and still auto-merges; everything else auto-merges only whendependabot/fetch-metadataclassifies it minor or patch, so an unclassified update waits for a person.contents: writeandpull-requests: writeto its job only, withdependabot/fetch-metadataSHA-pinned at v3.1.0.pm-beads-lgqsand the changelog.Written for commit af6a4fc. Summary will update on new commits.