ci(github): configure dependabot automation#20
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c118800f7f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| run: gh pr merge --auto --squash "$PR_URL" | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
When this enables auto-merge with secrets.GITHUB_TOKEN, the eventual merge is attributed to the workflow token, and GitHub documents that events triggered by GITHUB_TOKEN do not create new workflow runs except dispatch and selected PR events. In this repo the main Build and Pages deploy jobs are both push-triggered on main, so auto-merged Dependabot updates can land without running those post-merge workflows; use a GitHub App/PAT token for the merge step if those main-branch workflows must run after dependency updates.
Useful? React with 👍 / 👎.
1 participant
Summary
Updates this repo's Dependabot and dependency automation to match the newer LayeredCraft pattern. This adds grouped NuGet updates, GitHub Actions and uv ecosystem checks, plus automatic approval/auto-merge for safe Dependabot patch and minor updates.
Changes
.github/dependabot.ymlwith cooldowns, conventional commit metadata, infrastructure multi-ecosystem grouping, separate NuGet minor/patch vs. major groups, GitHub Actions updates, and uv updates..github/workflows/dependabot-auto-merge.ymlto auto-approve and enable squash auto-merge for Dependabot semver patch/minor PRs only.requirements.txttopyproject.toml/uv.lockso Dependabot can manage the docs dependency graph through theuvecosystem..github/workflows/docs.ymlto install dependencies withuv sync --lockedand build withuv run mkdocs build --clean.LayeredCraft.Lambda.AspNetCore.HostingExtensions.slnx.Validation
uv sync --lockedsuccessfully.uv run mkdocs build --cleansuccessfully.dotnet restore LayeredCraft.Lambda.AspNetCore.HostingExtensions.slnxsuccessfully.dotnet build LayeredCraft.Lambda.AspNetCore.HostingExtensions.slnx --no-restoresuccessfully.Notes for Reviewers
No conditional Microsoft.Extensions package ranges were needed for this repo.