feat(release): publish @opencoven/coven wrapper alongside @opencoven/cli #33
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # Auto-merge low-risk Dependabot version bumps. | |
| # | |
| # Scope: semver patch + minor updates. Dependabot ships security fixes as | |
| # patch/minor bumps, so this reliably covers them; major-version bumps are left | |
| # for manual review. Gating uses the `update-type` metadata output, which works | |
| # with the default GITHUB_TOKEN. | |
| # | |
| # Why not gate on `ghsa-id` (true security-only): the `ghsa-id`/`alert-state` | |
| # outputs are populated only when `alert-lookup: true` AND `github-token` is a | |
| # PAT or GitHub App token with "Dependabot alerts: read" — the default | |
| # GITHUB_TOKEN cannot read alerts, so that gate would silently never fire. If | |
| # such a token is provisioned later, switch to alert-lookup for precise | |
| # security-only scope. | |
| # | |
| # `pull_request_target` runs in the base-repo context so the GITHUB_TOKEN can | |
| # enable auto-merge (Dependabot PRs get a read-only token under `pull_request`). | |
| # This workflow never checks out or executes PR code — it only reads metadata | |
| # and calls the merge API — so the elevated trigger is safe here. | |
| # | |
| # `main` is not branch-protected, so auto-merge is not a hard CI gate: it merges | |
| # once the CI checks that are pending at enable-time succeed. If a strict | |
| # "CI must pass" guarantee is wanted later, add a required status check on main. | |
| on: pull_request_target | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| runs-on: ubuntu-latest | |
| if: ${{ github.actor == 'dependabot[bot]' }} | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: meta | |
| uses: dependabot/fetch-metadata@v3 | |
| - name: Enable auto-merge for patch and minor updates | |
| if: ${{ steps.meta.outputs.update-type == 'version-update:semver-patch' || steps.meta.outputs.update-type == 'version-update:semver-minor' }} | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |