Skip to content

Commit 40ccd44

Browse files
MitaliBhallacursoragent
MitaliBhalla
and
cursoragent
committed
ROSA-745: add per-repo Dependabot config (draft)
Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 77b3287 commit 40ccd44

2 files changed

Lines changed: 154 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "docker"
4+
directory: "/"
5+
labels:
6+
- "area/dependency"
7+
- "ok-to-test"
8+
schedule:
9+
interval: "weekly"
10+
open-pull-requests-limit: 10
11+
- package-ecosystem: gomod
12+
directory: "/"
13+
labels:
14+
- "area/dependency"
15+
- "ok-to-test"
16+
schedule:
17+
interval: "weekly"
18+
open-pull-requests-limit: 10
19+
groups:
20+
aws-sdk:
21+
patterns:
22+
- "github.com/aws/aws-sdk-go-v2*"
23+
kubernetes:
24+
patterns:
25+
- "k8s.io/*"
26+
- "sigs.k8s.io/*"
27+
openshift:
28+
patterns:
29+
- "github.com/openshift/*"

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
name: Dependabot Auto-Merge
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened, ready_for_review]
6+
7+
permissions:
8+
contents: write
9+
pull-requests: write
10+
checks: read
11+
actions: read
12+
13+
jobs:
14+
auto-merge:
15+
runs-on: ubuntu-latest
16+
# Only run for Dependabot PRs on the upstream repository (not forks)
17+
if: github.actor == 'dependabot[bot]' && github.repository == 'openshift/backplane-cli'
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
22+
- name: Fetch Dependabot Metadata
23+
id: metadata
24+
uses: dependabot/fetch-metadata@v2
25+
with:
26+
github-token: "${{ secrets.GITHUB_TOKEN }}"
27+
28+
- name: Check PR Labels
29+
id: check-labels
30+
run: |
31+
# Since this job only runs for Dependabot PRs (filtered at job level),
32+
# we allow all Dependabot PRs regardless of labels since they are inherently dependency updates
33+
echo "has-required-labels=true" >> $GITHUB_OUTPUT
34+
echo "✅ Dependabot PR detected - auto-merge enabled for safe updates"
35+
36+
- name: Enable Auto-Merge for Safe Updates
37+
if: |
38+
steps.check-labels.outputs.has-required-labels == 'true' && (
39+
steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
40+
steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
41+
steps.metadata.outputs.update-type == 'version-update:semver-digest'
42+
)
43+
run: |
44+
echo "Enabling auto-merge for ${{ steps.metadata.outputs.update-type }} update"
45+
echo "Dependency: ${{ steps.metadata.outputs.dependency-names }}"
46+
echo "Previous version: ${{ steps.metadata.outputs.previous-version }}"
47+
echo "New version: ${{ steps.metadata.outputs.new-version }}"
48+
49+
# Set GH_TOKEN for curl commands (token is automatically masked in logs)
50+
GH_TOKEN="${{ secrets.GITHUB_TOKEN }}"
51+
export GH_TOKEN
52+
53+
# Get PR node ID for GraphQL mutation
54+
PR_NODE_ID=$(curl -s \
55+
-H "Accept: application/vnd.github+json" \
56+
-H "Authorization: Bearer $GH_TOKEN" \
57+
"https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}" \
58+
| jq -r '.node_id')
59+
60+
if [[ -z "$PR_NODE_ID" || "$PR_NODE_ID" == "null" ]]; then
61+
echo "❌ Failed to fetch PR node ID"
62+
exit 1
63+
fi
64+
65+
echo "PR Node ID: $PR_NODE_ID"
66+
67+
# Enable auto-merge using GraphQL API (only way that works)
68+
response=$(curl -s -w "%{http_code}" -o /tmp/response.json \
69+
-X POST \
70+
-H "Accept: application/vnd.github+json" \
71+
-H "Authorization: Bearer $GH_TOKEN" \
72+
"https://api.github.com/graphql" \
73+
-d "{\"query\":\"mutation { enablePullRequestAutoMerge(input: { pullRequestId: \\\"$PR_NODE_ID\\\", mergeMethod: SQUASH }) { pullRequest { autoMergeRequest { enabledAt } } } }\"}")
74+
75+
if [[ "$response" -eq 200 ]]; then
76+
echo "✅ Auto-merge enabled successfully via GraphQL"
77+
cat /tmp/response.json
78+
else
79+
echo "❌ Failed to enable auto-merge. HTTP status: $response"
80+
echo "Response body:"
81+
cat /tmp/response.json
82+
echo "::warning::Could not enable auto-merge due to permissions. PR labeled for manual review."
83+
84+
# Add a comment to the PR explaining the situation (token is automatically masked)
85+
curl -s -X POST \
86+
-H "Accept: application/vnd.github+json" \
87+
-H "Authorization: Bearer $GH_TOKEN" \
88+
"https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
89+
-d '{"body":"🤖 **Dependabot Auto-Merge Status**\n\nThis PR meets the criteria for auto-merge but could not be automatically merged due to repository permissions.\n\n**Details:**\n- Update type: ${{ steps.metadata.outputs.update-type }}\n- Dependencies: ${{ steps.metadata.outputs.dependency-names }}\n- Previous version: ${{ steps.metadata.outputs.previous-version }}\n- New version: ${{ steps.metadata.outputs.new-version }}\n\nPlease review and merge manually if appropriate."}'
90+
fi
91+
92+
- name: Comment on Major Version Updates
93+
if: |
94+
steps.check-labels.outputs.has-required-labels == 'true' &&
95+
steps.metadata.outputs.update-type == 'version-update:semver-major'
96+
run: |
97+
# Set GH_TOKEN for curl commands (token is automatically masked in logs)
98+
GH_TOKEN="${{ secrets.GITHUB_TOKEN }}"
99+
export GH_TOKEN
100+
101+
# Add a comment to the PR explaining major version update (token is automatically masked)
102+
curl -s -X POST \
103+
-H "Accept: application/vnd.github+json" \
104+
-H "Authorization: Bearer $GH_TOKEN" \
105+
"https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \
106+
-d '{"body":"🚨 **Major Version Update Detected** 🚨\n\nThis PR contains a major version update that requires manual review:\n- **Dependency:** ${{ steps.metadata.outputs.dependency-names }}\n- **Previous version:** ${{ steps.metadata.outputs.previous-version }}\n- **New version:** ${{ steps.metadata.outputs.new-version }}\n\nPlease review the changelog and breaking changes before merging.\n\nAuto-merge has been **disabled** for this PR."}'
107+
108+
- name: Log Auto-Merge Decision
109+
run: |
110+
echo "Auto-merge decision for PR #${{ github.event.pull_request.number }}:"
111+
echo "- Update type: ${{ steps.metadata.outputs.update-type }}"
112+
echo "- Has required labels: ${{ steps.check-labels.outputs.has-required-labels }}"
113+
echo "- Dependency: ${{ steps.metadata.outputs.dependency-names }}"
114+
115+
if [[ "${{ steps.metadata.outputs.update-type }}" == "version-update:semver-patch" ]] || \
116+
[[ "${{ steps.metadata.outputs.update-type }}" == "version-update:semver-minor" ]] || \
117+
[[ "${{ steps.metadata.outputs.update-type }}" == "version-update:semver-digest" ]]; then
118+
if [[ "${{ steps.check-labels.outputs.has-required-labels }}" == "true" ]]; then
119+
echo "✅ Auto-merge ENABLED"
120+
else
121+
echo "❌ Auto-merge DISABLED: Missing required labels"
122+
fi
123+
else
124+
echo "❌ Auto-merge DISABLED: Major version update or unknown update type"
125+
fi

0 commit comments

Comments
 (0)