feat(tick): community.bsl c00-c04 — the census and the org-weight decomposition (Community Task 8) #732
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependabot Auto-Merge Workflow | |
| # | |
| # Merges Dependabot PRs to `dev` after EVERY check completes clean. | |
| # - Minor/patch version updates: eligible (low risk) | |
| # - GitHub Actions non-major updates: eligible | |
| # - Major updates: require manual review (breaking changes) | |
| # | |
| # ADR181 R2b (2026-07-30): `gh pr merge --auto` is BANNED repo-wide — the | |
| # #392 scar proved it merges past failing NON-required checks. This job | |
| # instead waits for every other check to complete (bounded poll, Power-of-10 | |
| # rule 2), refuses on ANY failure — required or not — and only then merges. | |
| name: Dependabot Auto-Merge | |
| on: | |
| pull_request: | |
| branches: | |
| - dev # Only trigger for PRs targeting dev | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| dependabot-automerge: | |
| name: Auto-merge Dependabot PRs | |
| runs-on: ubuntu-latest | |
| # Bounded wait: 40 polls x 60s inside a hard job ceiling. | |
| timeout-minutes: 45 | |
| if: github.actor == 'dependabot[bot]' | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v3 | |
| with: | |
| github-token: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Log update details | |
| run: | | |
| echo "Dependency: ${{ steps.metadata.outputs.dependency-names }}" | |
| echo "Update type: ${{ steps.metadata.outputs.update-type }}" | |
| echo "Ecosystem: ${{ steps.metadata.outputs.package-ecosystem }}" | |
| echo "Previous version: ${{ steps.metadata.outputs.previous-version }}" | |
| echo "New version: ${{ steps.metadata.outputs.new-version }}" | |
| # One merge path for every eligible class: wait for all OTHER checks, | |
| # refuse on any failure (required or not), then a plain --squash merge. | |
| - name: Wait for all checks, refuse on any failure, then merge | |
| if: | | |
| steps.metadata.outputs.update-type == 'version-update:semver-patch' || | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor' || | |
| (steps.metadata.outputs.package-ecosystem == 'github_actions' && | |
| steps.metadata.outputs.update-type != 'version-update:semver-major') | |
| run: | | |
| SELF="Auto-merge Dependabot PRs" | |
| for i in $(seq 1 40); do | |
| checks=$(gh pr checks "$PR_URL" --json name,bucket 2>/dev/null || echo '[]') | |
| failed=$(jq --arg self "$SELF" \ | |
| '[.[] | select(.bucket == "fail" and .name != $self)] | length' <<<"$checks") | |
| pending=$(jq --arg self "$SELF" \ | |
| '[.[] | select(.bucket == "pending" and .name != $self)] | length' <<<"$checks") | |
| if [ "$failed" -gt 0 ]; then | |
| gh pr comment "$PR_URL" --body \ | |
| "Auto-merge REFUSED: $failed check(s) failed. ADR181 R2b — a \ | |
| failing check blocks the merge even when non-required (the #392 class)." | |
| exit 1 | |
| fi | |
| if [ "$pending" -eq 0 ] && [ "$checks" != "[]" ]; then | |
| echo "All checks complete and clean — merging." | |
| gh pr merge --squash "$PR_URL" | |
| exit 0 | |
| fi | |
| echo "poll $i/40: $pending check(s) still pending" | |
| sleep 60 | |
| done | |
| echo "Checks did not complete inside the wait budget — NOT merging." | |
| exit 1 | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # MAJOR updates require manual review - just add a comment | |
| - name: Comment on major updates | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-major' | |
| run: | | |
| gh pr comment "$PR_URL" --body \ | |
| "**Major version update** - may contain breaking changes. Manual review required." | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |