Problem
The auto-merge workflow skipped all major Dependabot bumps, so major updates sat blocked. phaemos auto-deploys to Render/Vercel on merge, so blanket auto-merge of major runtime bumps is unsafe.
Fix
Ecosystem-aware auto-merge:
- Patch/minor bumps (any ecosystem) and major GitHub Actions bumps auto-merge once CI passes.
- Major
npm / pip bumps are held for manual review (a breaking runtime change could pass ruff, pytest and the Next.js build and still deploy).
- Non-Dependabot PRs opt in with an
automerge label.
Also adds a Repo maintenance workflow to delete merged branches the token could not clean up.
Problem
The auto-merge workflow skipped all major Dependabot bumps, so major updates sat blocked. phaemos auto-deploys to Render/Vercel on merge, so blanket auto-merge of major runtime bumps is unsafe.
Fix
Ecosystem-aware auto-merge:
npm/pipbumps are held for manual review (a breaking runtime change could pass ruff, pytest and the Next.js build and still deploy).automergelabel.Also adds a
Repo maintenanceworkflow to delete merged branches the token could not clean up.