Repository navigation
Auto-merge green Dependabot updates and group the pm toolchain into one daily PR - #125
Merged
Merged
Conversation
…ne daily PR Version bumps of @unbrained/pm-cli, pm-ops and pm-changelog are mechanical. Dependabot now checks npm daily and groups the pm toolchain (and other minor/patch updates) into single pull requests; a least-privilege workflow enables squash auto-merge for every non-major Dependabot PR, so it lands as soon as the required checks pass and a failing bump stays open as a defect. pm item: pm-slack-nra8
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (5)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. Summary by CodeRabbit
WalkthroughDependabot npm updates now run daily in separate toolchain and dependency groups. A new workflow enables squash auto-merge for eligible Dependabot pull requests. Task records and the changelog document the update criteria and rollout. ChangesDependabot update automation
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant Dependabot
participant Workflow as GitHub Actions workflow
participant Metadata as Dependabot metadata action
participant GitHub as GitHub auto-merge
Dependabot->>Workflow: Opens a pull request
Workflow->>Metadata: Retrieves dependency update metadata
Metadata-->>Workflow: Returns dependency group and update type
Workflow->>GitHub: Enables squash auto-merge when eligible
Merge Risk: ⚪ Minimal · up to The daily update groups and conditional auto-merge have no established merge-blocking issue. Eligible updates remain subject to the required checks. Security Architecture ReviewSecurity architecture risk: 🔵 Low · up to The automation is narrowly gated to Dependabot, does not execute pull-request contents, and explicitly limits ordinary updates to minor or patch versions. However, its safety depends on repository merge protections and pending auto-merge behavior that could not be independently verified. Retained concerns Security review detailsSecurity Blast Radius
Trust Boundaries and Controls
Resilience and Maintainability Implications
Hardening Proposals
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThis PR makes npm Dependabot checks daily, groups the pm CLI toolchain separately from other dependency updates, and adds a least-privilege workflow that automatically squash-merges eligible Dependabot PRs once required checks pass while leaving unrelated major updates for manual review. Sequence diagram for Dependabot auto-merge workflowsequenceDiagram
participant Dependabot
participant GitHub
participant Metadata as fetch-metadata
participant Checks as RequiredChecks
participant Merge as gh_pr_merge
Dependabot->>GitHub: Open pull request
GitHub->>Metadata: fetch-metadata
Metadata-->>GitHub: dependency-group and update-type
alt pm-toolchain group
GitHub->>Merge: gh pr merge --auto --squash
else non-major update
GitHub->>Merge: gh pr merge --auto --squash
else unrelated major update
GitHub-->>Dependabot: Keep PR open for manual review
end
Merge->>Checks: Wait for required checks
Checks-->>Merge: test (22) and test (26) pass
Merge-->>GitHub: Squash-merge PR
Flow diagram for daily Dependabot groupingflowchart TD
Daily[Daily npm Dependabot check] --> PM{Matches pm-toolchain patterns}
Daily --> Other{Matches other dependency patterns}
PM --> PMPR[One pm-toolchain PR]
Other --> MinorPatch{Minor or patch update}
MinorPatch --> DepPR[One dependencies PR]
Other --> Major[Major update]
Major --> Manual[Separate PR for manual review]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
 |
pm item: pm-slack-nra8
Owner
Author
|
@coderabbitai full review |
Rate Limit Exceeded
|
…sions Review feedback: an update that fetch-metadata cannot classify must not auto-merge, so the condition now requires semver-minor or semver-patch outside the calendar-versioned pm-toolchain group. The job's write scopes are documented, the dependencies group selects every package explicitly, and the item's acceptance criteria name the pm-toolchain exception. pm item: pm-slack-nra8
Owner
Author
|
@coderabbitai full review |
✅ Action performedFull review finished. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/dependabot.yml: npm is checked daily;@unbrained/pm-cliandpm-*packages arrive as onepm-toolchainPR, other minor/patch updates as onedependenciesPR. Other ecosystems are unchanged..github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only inunbraind),dependabot/fetch-metadata(SHA-pinned v3.1.0) classifies the update; thepm-toolchaingroup (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update getgh pr merge --auto --squash. Workflow default permissions are{}; the job alone getscontents: write+pull-requests: write.Why
Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires
test (22),test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.pm item
Summary by Sourcery
Automate the delivery of compatible Dependabot updates while preserving review and branch-protection gates for major or failing changes.
New Features:
Enhancements:
Documentation:
Chores:
Summary by cubic
Automates pm toolchain version bumps by grouping Dependabot npm updates into one daily PR and auto-merging green, non-major PRs so releases land without a hand-written certification PR.
@unbrained/pm-cliandpm-*packages group into onepm-toolchainPR and remaining minor/patch updates into onedependenciesPR.pm-toolchaingroup (calendar-versioned, so year rollovers read as semver-major) and, for theunbraindorg only, updates explicitly classified minor or patch; unclassified updates never auto-merge.Written for commit cee07b1. Summary will update on new commits.