From 25a7747e528c2992feeb62265fae1b2674a1ff6a Mon Sep 17 00:00:00 2001 From: Frederic BIDON Date: Thu, 25 Jan 2024 14:57:58 +0100 Subject: [PATCH 1/2] ci: configured auto-approve & auto-merge for github actions Signed-off-by: Frederic BIDON --- .github/dependabot.yaml | 45 +++++++++++++++++++++++++------- .github/workflows/auto-merge.yml | 36 +++++++++++++++++++++++++ 2 files changed, 72 insertions(+), 9 deletions(-) create mode 100644 .github/workflows/auto-merge.yml diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index adc2943..a137b9d 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -1,11 +1,38 @@ version: 2 updates: -- package-ecosystem: "gomod" - directory: "/" - schedule: - interval: "daily" - open-pull-requests-limit: 10 -- package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + #interval: "weekly" + #day: "friday" + open-pull-requests-limit: 3 # <- default is 5 + groups: # <- group all github actions updates in a single PR + development-dependencies: + dependency-type: development + patterns: + - '*' + + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "daily" + #interval: "weekly" + #day: "friday" + open-pull-requests-limit: 3 + groups: + development-dependencies: + dependency-type: development + patterns: + - "github.com/stretchr/testify" + go-openapi-dependencies: + dependency-type: production + patterns: + - "github.com/go-openapi/*" + + other-direct-dependencies: + dependency-type: production + exclude-patterns: + - "github.com/go-openapi/*" + - "github.com/stretchr/testify" + diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml new file mode 100644 index 0000000..de66f7a --- /dev/null +++ b/.github/workflows/auto-merge.yml @@ -0,0 +1,36 @@ +name: Dependabot auto-merge +on: pull_request + +permissions: + contents: write + pull-requests: write + +jobs: + dependabot: + runs-on: ubuntu-latest + if: github.actor == 'dependabot[bot]' + steps: + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v1 + + - name: Auto-approve dependabot PRs + run: gh pr review --approve "$PR_URL" + env: + PR_URL: ${{github.event.pull_request.html_url}} + GH_TOKEN: ${{secrets.GITHUB_TOKEN}} + + - name: Auto-merge dependabot PRs for development dependencies + if: contains(steps.metadata.outputs.dependency-group, 'development-dependencies') + run: gh pr merge --auto --rebase "$PR_URL" + env: + PR_URL: ${{github.event.pull_request.html_url}} + GH_TOKEN: ${{secrets.GITHUB_TOKEN}} + + - name: Auto-merge dependabot PRs for go-openapi patches + if: contains(steps.metadata.outputs.dependency-group, 'go-openapi-dependencies') && steps.metadata.outputs.update-type == 'version-update:semver-patch' + run: gh pr merge --auto --rebase "$PR_URL" + env: + PR_URL: ${{github.event.pull_request.html_url}} + GH_TOKEN: ${{secrets.GITHUB_TOKEN}} + From c0ee9474e4e3ace4dad45387c8e9be84aa4cb178 Mon Sep 17 00:00:00 2001 From: Frederic BIDON Date: Thu, 25 Jan 2024 17:01:15 +0100 Subject: [PATCH 2/2] ci: configured auto-merge for dependabots * All groups are checked once a week and each produce at most 1 PR. * All dependabot PRs are auto-approved Caveats: * this requires auto-merge to be enabled in the repository settings [done] * this requires all desired tests to be required in the branch protection rule [done] - package-ecosystem: "github-actions" # 1. development-dependencies are auto-merged - package-ecosystem: "gomod" # We define 4 groups of dependencies to regroup update pull requests: # - development (e.g. test dependencies) # - go-openapi updates # - golang.org (e.g. golang.org/x/... packages) # - other dependencies (direct or indirect) # # # Auto-merging policy, when requirements are met: # 1. development-dependencies are auto-merged # 2. golang.org-dependencies are auto-merged # 3. go-openapi patch updates are auto-merged. Minor/major version updates require a manual merge. # 4. other dependencies require a manual merge Signed-off-by: Frederic BIDON --- .github/dependabot.yaml | 39 ++++++++++++++++++++++++-------- .github/workflows/auto-merge.yml | 9 +++++++- 2 files changed, 37 insertions(+), 11 deletions(-) diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml index a137b9d..d53b535 100644 --- a/.github/dependabot.yaml +++ b/.github/dependabot.yaml @@ -3,36 +3,55 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "daily" - #interval: "weekly" - #day: "friday" - open-pull-requests-limit: 3 # <- default is 5 + interval: "weekly" + day: "friday" + open-pull-requests-limit: 2 # <- default is 5 groups: # <- group all github actions updates in a single PR + # 1. development-dependencies are auto-merged development-dependencies: dependency-type: development patterns: - '*' - package-ecosystem: "gomod" + # We define 4 groups of dependencies to regroup update pull requests: + # - development (e.g. test dependencies) + # - go-openapi updates + # - golang.org (e.g. golang.org/x/... packages) + # - other dependencies (direct or indirect) + # + # * All groups are checked once a week and each produce at most 1 PR. + # * All dependabot PRs are auto-approved + # + # Auto-merging policy, when requirements are met: + # 1. development-dependencies are auto-merged + # 2. golang.org-dependencies are auto-merged + # 3. go-openapi patch updates are auto-merged. Minor/major version updates require a manual merge. + # 4. other dependencies require a manual merge directory: "/" schedule: - interval: "daily" - #interval: "weekly" - #day: "friday" - open-pull-requests-limit: 3 + interval: "weekly" + day: "friday" + open-pull-requests-limit: 4 groups: development-dependencies: dependency-type: development patterns: - "github.com/stretchr/testify" + + golang.org-dependencies: + dependency-type: production + patterns: + - "golang.org/*" + go-openapi-dependencies: dependency-type: production patterns: - "github.com/go-openapi/*" - other-direct-dependencies: + other-dependencies: dependency-type: production exclude-patterns: - "github.com/go-openapi/*" - "github.com/stretchr/testify" - + - "golang.org/*" diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index de66f7a..7ec23aa 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -14,7 +14,7 @@ jobs: id: metadata uses: dependabot/fetch-metadata@v1 - - name: Auto-approve dependabot PRs + - name: Auto-approve all dependabot PRs run: gh pr review --approve "$PR_URL" env: PR_URL: ${{github.event.pull_request.html_url}} @@ -34,3 +34,10 @@ jobs: PR_URL: ${{github.event.pull_request.html_url}} GH_TOKEN: ${{secrets.GITHUB_TOKEN}} + - name: Auto-merge dependabot PRs for golang.org updates + if: contains(steps.metadata.outputs.dependency-group, 'golang.org-dependencies') + run: gh pr merge --auto --rebase "$PR_URL" + env: + PR_URL: ${{github.event.pull_request.html_url}} + GH_TOKEN: ${{secrets.GITHUB_TOKEN}} +