From 0a72a980847143f918e70e125706d371a5a702cb Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 21 Jul 2026 07:41:32 -0400 Subject: [PATCH 1/3] ci: add dependabot auto-merge workflow + expand ecosystem coverage Auto-approve and auto-merge patch/minor dependabot PRs (major stays manual). Also add dotnet-sdk, github-actions, and uv ecosystems (grouped under an infrastructure multi-ecosystem-group) alongside the existing nuget config, mirroring dynamodb-efcore-provider. Co-Authored-By: Claude Sonnet 5 --- .github/dependabot.yml | 35 +++++++++++++++++++++ .github/workflows/dependabot-auto-merge.yml | 34 ++++++++++++++++++++ 2 files changed, 69 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e2379a0..c327a78 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,4 +1,15 @@ version: 2 + +multi-ecosystem-groups: + infrastructure: + schedule: + interval: "weekly" + day: "wednesday" + open-pull-requests-limit: 25 + commit-message: + prefix: "chore" + include: "scope" + updates: - package-ecosystem: "nuget" directory: "/" @@ -23,3 +34,27 @@ updates: - "major" patterns: - "*" + + - package-ecosystem: "dotnet-sdk" + directory: "/" + patterns: + - "*" + multi-ecosystem-group: "infrastructure" + cooldown: + default-days: 7 + + - package-ecosystem: "github-actions" + directory: "/" + patterns: + - "*" + multi-ecosystem-group: "infrastructure" + cooldown: + default-days: 7 + + - package-ecosystem: "uv" + directory: "/docsite" + patterns: + - "*" + multi-ecosystem-group: "infrastructure" + cooldown: + default-days: 7 diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..c2860dd --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,34 @@ +name: Dependabot auto-merge + +on: + pull_request_target: + types: [opened, synchronize, reopened] + +permissions: + contents: write + pull-requests: write + +jobs: + dependabot: + runs-on: ubuntu-latest + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'LayeredCraft/sharp-mud' + steps: + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3 + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" + + - name: Approve PR + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto-merge for Dependabot PRs + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From db8a3457a911d43a7b776085876b427f1ff89c3a Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 21 Jul 2026 07:57:04 -0400 Subject: [PATCH 2/3] ci: gate dependabot auto-merge on all PR checks, not just required ones Auto-merge only waits on branch-protection required checks (just build/build here), so a docsite-only uv bump or github-actions bump could merge while its own path-triggered check was still pending or red. Add an explicit gh pr checks --watch --fail-fast step so the workflow itself waits on every check before enabling auto-merge. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/dependabot-auto-merge.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index c2860dd..a9c6df8 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -26,6 +26,13 @@ jobs: PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Wait for all checks to pass + if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' + run: gh pr checks "$PR_URL" --watch --fail-fast + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Enable auto-merge for Dependabot PRs if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --squash "$PR_URL" From fd178019d1abc4dd18b485e9a9ffe1cb5107ea83 Mon Sep 17 00:00:00 2001 From: Nick Cipollina Date: Tue, 21 Jul 2026 08:02:25 -0400 Subject: [PATCH 3/3] ci: revert check-waiting gate on dependabot auto-merge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate protected against a docs-site or workflow-syntax bump merging while its own path-triggered check was still pending or red — but that's low-stakes and cheap to fix after the fact (docs site re-deploy, one-line revert), not an app-code risk. Real app code (nuget, dotnet-sdk) is already covered by the required build/build branch-protection check, which auto-merge already waits on. The poll-for-all-checks approach also had a self-deadlock bug (this workflow's own still-running check would never resolve). Keeping this repo's automation light per code-of-conduct.md outweighs closing a low-blast-radius gap with meaningfully more complexity. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/dependabot-auto-merge.yml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index a9c6df8..c2860dd 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -26,13 +26,6 @@ jobs: PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Wait for all checks to pass - if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' - run: gh pr checks "$PR_URL" --watch --fail-fast - env: - PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - name: Enable auto-merge for Dependabot PRs if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' run: gh pr merge --auto --squash "$PR_URL"