From 8267c975ccddc78a2281ab84bca0c4b5d8cffe54 Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 21 Jul 2026 08:36:21 -0400 Subject: [PATCH 1/4] fix: exempt dependabot PRs from title check by PR author, not event actor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit github.actor reflects whoever triggered the current event, not who owns the PR — so the skip stopped applying the moment a human pushed a follow-up commit (e.g. resolving a merge conflict) to an otherwise dependabot-authored PR, since that push's actor is the human, not dependabot[bot]. Keying off github.event.pull_request.user.login instead keeps the exemption tied to PR authorship, which doesn't change no matter who pushes to the branch afterward. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/pr-title-check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml index 642b450..735c314 100644 --- a/.github/workflows/pr-title-check.yml +++ b/.github/workflows/pr-title-check.yml @@ -10,7 +10,7 @@ permissions: jobs: validate: runs-on: ubuntu-latest - if: github.actor != 'dependabot[bot]' + if: github.event.pull_request.user.login != 'dependabot[bot]' steps: - uses: amannn/action-semantic-pull-request@v6 From f7306d47aede8eaf9b571aecb557398a84c26460 Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 21 Jul 2026 08:41:40 -0400 Subject: [PATCH 2/4] feat: dogfood this repo's own reusable workflows + add dependabot This repo ships reusable workflow templates for other repos but never called any of them on its own PRs/pushes - no title validation, no release drafting, no dependency updates for the actions its own workflows pin. - .github/dependabot.yml: track the github-actions ecosystem (this repo has no application code, just pinned actions in workflow files), grouped by minor/patch vs major like sharp-mud's config - dependabot-auto-merge.yml: same pattern as sharp-mud - auto-approve and auto-merge patch/minor dependabot PRs, leave majors for manual review - pr-title-check.yaml / release-drafter.yaml: thin callers that trigger on this repo's own pull_request/push events and invoke the existing reusable pr-title-check.yml/release-drafter.yml via relative path, mirroring exactly how sharp-mud consumes them Co-Authored-By: Claude Sonnet 5 --- .github/dependabot.yml | 25 +++++++++++++++ .github/workflows/dependabot-auto-merge.yml | 34 +++++++++++++++++++++ .github/workflows/pr-title-check.yaml | 13 ++++++++ .github/workflows/release-drafter.yaml | 20 ++++++++++++ 4 files changed, 92 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/dependabot-auto-merge.yml create mode 100644 .github/workflows/pr-title-check.yaml create mode 100644 .github/workflows/release-drafter.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..aed05a3 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,25 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "wednesday" + open-pull-requests-limit: 25 + cooldown: + default-days: 7 + commit-message: + prefix: "chore" + include: "scope" + groups: + actions-minor-patch: + update-types: + - "minor" + - "patch" + patterns: + - "*" + actions-major: + update-types: + - "major" + patterns: + - "*" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..fb7a4f9 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,34 @@ +name: Dependabot auto-merge + +on: + pull_request_target: + types: [opened, synchronize, reopened] + +permissions: + contents: write + pull-requests: write + +jobs: + dependabot: + runs-on: ubuntu-latest + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'LayeredCraft/devops-templates' + steps: + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3 + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" + + - name: Approve PR + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto-merge for Dependabot PRs + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pr-title-check.yaml b/.github/workflows/pr-title-check.yaml new file mode 100644 index 0000000..ee40d93 --- /dev/null +++ b/.github/workflows/pr-title-check.yaml @@ -0,0 +1,13 @@ +name: PR Title Check + +on: + pull_request: + types: [opened, edited, synchronize, reopened] + +permissions: + pull-requests: read + statuses: write + +jobs: + validate: + uses: ./.github/workflows/pr-title-check.yml diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml new file mode 100644 index 0000000..f3f76e5 --- /dev/null +++ b/.github/workflows/release-drafter.yaml @@ -0,0 +1,20 @@ +name: Release Drafter + +on: + push: + branches: + - main + pull_request: + types: [opened, edited, synchronize, reopened, ready_for_review] + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + draft: + uses: ./.github/workflows/release-drafter.yml + with: + event_name: ${{ github.event_name }} + pr_draft: ${{ github.event.pull_request.draft == true }} From 55c99aba6d2103e6cf521bbf0dbe36b65430dca1 Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 21 Jul 2026 08:43:12 -0400 Subject: [PATCH 3/4] fix: keep release-drafter versions at Major.Minor only Existing tag history (v8.3, v8.4, v9.0, v10.0, v10.1) is two-part, but the resolver config had three tiers (major/minor/patch) with the default $RESOLVED_VERSION template, which tracks a hidden $PATCH digit that was never displayed - two different patch-labeled merges in a row would have resolved to the same visible tag. Adds an explicit version-template of $MAJOR.$MINOR and collapses the minor/patch tiers into one: everything except 'breaking-change' now bumps $MINOR, so every release advances the visible version by exactly one step no matter which label it carries. Co-Authored-By: Claude Sonnet 5 --- .github/release-drafter.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml index a686049..6b154c5 100644 --- a/.github/release-drafter.yml +++ b/.github/release-drafter.yml @@ -1,7 +1,12 @@ name-template: 'v$RESOLVED_VERSION' tag-template: 'v$RESOLVED_VERSION' +version-template: '$MAJOR.$MINOR' commitish: main +# Two-part Major.Minor versioning only (no patch component) — every +# non-major label bumps $MINOR, so it increments on every release +# regardless of label instead of silently accumulating in a $PATCH +# digit that version-template above wouldn't even display. version-resolver: major: labels: @@ -9,8 +14,6 @@ version-resolver: minor: labels: - 'type: feat' - patch: - labels: - 'type: fix' - 'type: docs' - 'type: refactor' @@ -18,7 +21,7 @@ version-resolver: - 'type: chore' - 'type: ci' - 'type: revert' - default: patch + default: minor autolabeler: - label: 'type: feat' From 8b70379e181362a6eaf53449fb2feedc5e91af7d Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 21 Jul 2026 08:49:33 -0400 Subject: [PATCH 4/4] refactor: rename self-consuming callers with a local- prefix pr-title-check.yaml/release-drafter.yaml sitting next to pr-title-check.yml/release-drafter.yml was confusing - the .yaml vs .yml extension was the only visual signal distinguishing "the reusable template" from "the thing that actually runs on this repo's own PRs". Prefixing the callers local- makes that distinction explicit instead of relying on file extension. Co-Authored-By: Claude Sonnet 5 --- .../workflows/{pr-title-check.yaml => local-pr-title-check.yml} | 0 .../workflows/{release-drafter.yaml => local-release-drafter.yml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{pr-title-check.yaml => local-pr-title-check.yml} (100%) rename .github/workflows/{release-drafter.yaml => local-release-drafter.yml} (100%) diff --git a/.github/workflows/pr-title-check.yaml b/.github/workflows/local-pr-title-check.yml similarity index 100% rename from .github/workflows/pr-title-check.yaml rename to .github/workflows/local-pr-title-check.yml diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/local-release-drafter.yml similarity index 100% rename from .github/workflows/release-drafter.yaml rename to .github/workflows/local-release-drafter.yml