[unbraind]

What

• .github/dependabot.yml: npm is checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, other minor/patch updates as one dependencies PR. Other ecosystems are unchanged.
• .github/workflows/dependabot-auto-merge.yml: for Dependabot PRs only (and only in unbraind), dependabot/fetch-metadata (SHA-pinned v3.1.0) classifies the update; the pm-toolchain group (calendar-versioned, so a year rollover reads as semver-major) and every other non-major update get gh pr merge --auto --squash. Workflow default permissions are {}; the job alone gets contents: write + pull-requests: write.
• Repository setting: auto-merge allowed, merged branches deleted.

Why

Fleet rule ([companion pm-cli-website-6d05]): a pm CLI release must reach every package without a hand-written certification PR. Branch protection still requires test (22), test (26), so nothing merges red; a bump that fails CI stays open as a real defect. Major updates still need a person. Same change as the reviewed pilot unbraind/pm-presets#118.

pm item

• pm-web-56no

---

Summary by cubic

Auto-merges green Dependabot updates and groups the pm toolchain into one daily PR, so version bumps land without a hand-written certification PR.

• npm is now checked daily; @unbrained/pm-cli and pm-* packages arrive as one pm-toolchain PR, and all other dependencies as a disjoint dependencies PR.
• A least-privilege workflow enables GitHub squash auto-merge; branch protection still requires the test checks, so a failing bump stays open as a defect.
• The pm-toolchain group is calendar-versioned, so a year rollover reads as semver-major and still auto-merges; outside that group, only updates classified minor or patch auto-merge, so anything major or unclassified waits for a person.
• Requires the repository setting that allows auto-merge; no manual rollout steps needed.

^{Written for commit d0553ac. Summary will update on new commits.}

Summary by Sourcery

Automate safe Dependabot updates and coordinate daily pm toolchain version bumps through grouped pull requests.

New Features:

• Automatically enable squash auto-merge for eligible green Dependabot pull requests while leaving major or unclassified updates for manual review.

Enhancements:

• Group the pm CLI toolchain into a single daily Dependabot pull request and consolidate other minor and patch npm updates separately.

Chores:

• Allow repository auto-merge and configure merged branches for deletion.

[sourcery-ai]

Sorry @unbraind, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 15 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: unbraind/pm-web/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: a3056e2a-b089-4ac5-84b8-a0100992a3df

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

This PR changes npm Dependabot to run daily and consolidate updates into a separately handled pm toolchain group and a minor/patch dependency group. A SHA-pinned, least-privilege workflow enables squash auto-merge for green Dependabot PRs, including calendar-versioned pm toolchain rollovers, while leaving other major updates for manual review; the repository is also configured to allow auto-merge and delete merged branches.

File-Level Changes

Change	Details	Files
Configure daily npm Dependabot updates with explicit grouping for the pm toolchain and non-major general dependencies.	Change npm checks from weekly to daily. Group @unbrained/pm-cli and pm-* packages into pm-toolchain without update-type filtering. Group all remaining minor and patch updates into dependencies while excluding pm packages.	.github/dependabot.yml
Add a least-privilege workflow that enables squash auto-merge for eligible Dependabot pull requests after required checks pass.	Restrict execution to Dependabot PRs in the unbraind organization. Fetch pinned Dependabot metadata to identify dependency groups and update types. Auto-merge the pm-toolchain group and all non-major updates, leaving unrelated major updates for manual review. Set empty workflow-level permissions and grant write permissions only to the job.	.github/workflows/dependabot-auto-merge.yml
Record the associated pm work item and history artifacts.	Add the pm-web-56no task definition. Add the corresponding JSONL history entry.	.agents/pm/tasks/pm-web-56no.toon .agents/pm/history/pm-web-56no.jsonl

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[greptile-apps]

Confidence Score: 5/5

[High risk] Enables automatic merging of dependency updates via CI workflow.

The changes since the previous review appear safe to merge.

What we checked:

• Toolchain packages stay together: Both toolchain patterns appear unchanged in the other group's exclusions, so the catch-all cannot move matching packages there.

Summary

Adds daily npm groups and a Dependabot-only workflow that requests squash auto-merge.

• pm-toolchain and dependencies have matching exclusions, keeping their packages separate.
• The latest changes explicitly allow minor and patch updates outside pm-toolchain. Major and unclassified updates wait for a person.
• unbraind explicitly intends calendar-versioned pm-toolchain updates to merge without manual approval, including year rollovers.
• No new actionable issues were found. No previous review threads were supplied.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Dependabot pull request] --> B{Author and owner match?}
  B -->|No| C[Skip job]
  B -->|Yes| D[Read update metadata]
  D --> E{pm-toolchain or minor or patch?}
  E -->|No| F[Leave for a person]
  E -->|Yes| G[Request squash auto-merge]
  G --> H[GitHub applies required merge checks]

Loading

_{Reviews (3) · Last reviewed commit: "Allow-list minor and patch updates and d..."}

[unbraind]

@coderabbitai full review
@greptileai review

[coderabbitai]

Rate Limit Exceeded

@unbraind have exceeded the limit for the number of chat messages per hour. Please wait 14 minutes and 22 seconds before sending another message.

[unbraind]

@coderabbitai full review
@greptileai review

[coderabbitai]

Rate Limit Exceeded

@unbraind have exceeded the limit for the number of chat messages per hour. Please wait 54 minutes and 5 seconds before sending another message.