asepharyana
0810ff1373
Root cause of recurring breaking bumps: dependabot-auto-merge ran gh pr merge --auto with no CI gate and the repo has no branch protection, so PRs merged the moment checks finished — including FAILED ones (eslint@10, tsparticles@4, typescript@7 all landed repeatedly). Add a github-script step: list check-runs for the PR head, fail unless all checks completed AND none failed. Breaking bumps now block instead of silently landing.
44 lines
1.7 KiB
YAML
44 lines
1.7 KiB
YAML
name: Dependabot Auto-Merge
|
|
on: pull_request
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
checks: read
|
|
|
|
jobs:
|
|
auto-merge:
|
|
runs-on: ubuntu-latest
|
|
# Only for dependabot PRs whose CI is green: the "CI" workflow must have
|
|
# completed successfully before auto-merge is enabled. Without this guard,
|
|
# gh pr merge --auto merges as soon as checks finish — including failures
|
|
# (breaking bumps like eslint@10 / tsparticles@4 / typescript@7 landed
|
|
# repeatedly because of that).
|
|
if: github.actor == 'dependabot[bot]'
|
|
steps:
|
|
- name: Wait for CI checks to pass
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
const { data: checks } = await github.rest.checks.listForRef({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
ref: context.payload.pull_request.head.sha,
|
|
});
|
|
const pending = checks.check_runs.filter((c) => c.status !== "completed");
|
|
if (pending.length > 0) {
|
|
core.setFailed(`CI not finished yet: ${pending.map((c) => c.name).join(", ")}`);
|
|
return;
|
|
}
|
|
const failed = checks.check_runs.filter((c) => c.conclusion === "failure");
|
|
if (failed.length > 0) {
|
|
core.setFailed(`CI failed: ${failed.map((c) => c.name).join(", ")}`);
|
|
return;
|
|
}
|
|
core.notice(`All ${checks.check_runs.length} checks passed — enabling auto-merge.`);
|
|
|
|
- name: Enable auto-merge for Dependabot PR
|
|
run: gh pr merge --auto --merge "$PR_URL"
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |