chore(deps): bump KineticCafe/actions-dco from 3.1.1 to 3.2.0 #267
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot Auto-merge | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| # Workflow defaults to read-only (principle of least privilege). | |
| # The auto-merge job below escalates to the writes it actually needs. | |
| permissions: | |
| contents: read | |
| jobs: | |
| auto-merge: | |
| runs-on: ubuntu-latest | |
| if: github.actor == 'dependabot[bot]' | |
| permissions: | |
| contents: write # required by `gh pr merge --auto` to enqueue merge | |
| pull-requests: write # required to comment / update PR state | |
| steps: | |
| - name: Detect self-modifying changes | |
| # Block auto-merge for any PR that touches this workflow file itself. | |
| # Without this guard a Dependabot bump of an action used here could silently | |
| # change merge behavior on every future PR. | |
| id: workflow-touch | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| REPO: ${{ github.repository }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| if gh api "repos/$REPO/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename' \ | |
| | grep -Fxq '.github/workflows/dependabot-auto-merge.yml'; then | |
| echo "self_modifying=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "self_modifying=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Fetch Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Auto-merge eligible updates | |
| # Eligibility rules: | |
| # - Any ecosystem: semver-patch only (SemVer contract: bug fixes, no behavior change). | |
| # - github_actions: also accept semver-minor (sandboxed, additive features rarely break inputs). | |
| # - Block any PR that touches this workflow file itself (self-modifying automation risk). | |
| # - All other updates (majors, non-actions minors) require human review. | |
| if: | | |
| steps.workflow-touch.outputs.self_modifying == 'false' && | |
| ( | |
| steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| ( | |
| steps.metadata.outputs.package-ecosystem == 'github_actions' && | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor' | |
| ) | |
| ) | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh pr merge --auto --squash "$PR_URL" |