Repository navigation
Check dependencies daily and auto-merge patch updates - #144
Draft
adamgrossman wants to merge 2 commits into
Draft
adamgrossman wants to merge 2 commits into
adamgrossman wants to merge 2 commits into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
💸 TL;DR
Template dependency updates currently wait for Monday or Tuesday checks and a manual merge. Check npm dependencies each weekday at 5 p.m. Eastern and enable auto-merge for verified Dependabot patch updates once required CI passes. This pilots the change in the React template.
📜 Details
Keep the existing dependency groups and cooldown exclusions. A small workflow uses
dependabot/fetch-metadatato verify Dependabot's commits and enable GitHub's native auto-merge when the highest reported update type is a patch. Groups containing minor or major upgrades stay for manual review. The workflow does not check out or execute PR code, and the merge command requires the PR head to match the triggering revision.GitHub enforces required checks and reviews. Before merging this PR, enable repository auto-merge and require the GitHub Actions
testcheck on an up-to-datemainbranch. Those repository settings are separate from this PR and are necessary for CI to gate automatic merges.Jira: No ticket.
🧪 Testing Steps / Validation
The Dependabot configuration parses, and the new workflow passes workflow validation. The app's CI workflow is unchanged. Live auto-merging has not been exercised; it requires the workflow on the base branch and the repository settings described above.
✅ Checks