From e2f186b5129072913b31aa42a39f1282f6f2e5a7 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 7 Aug 2026 15:55:44 -0700 Subject: [PATCH 1/2] feat(workflow-templates): add dependabot-auto-merge caller stub + properties MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors smartwatermelon/.github#11: replaces the self-contained dependabot-auto-merge.yml body with a caller stub pointing at the new reusable workflow in smartwatermelon/github-workflows (Part A2 of the reusable-workflows plan; see smartwatermelon/github-workflows#96). Adds the missing dependabot-auto-merge.properties.json so the workflow-templates picker actually offers this template — confirmed silently absent during Q2 planning validation. Temporarily pinned to a commit SHA rather than the dependabot-auto-merge-v1 tag, since that tag doesn't exist until github-workflows#96 merges and the tag is cut (~1 minute after merge, per this fleet's established convention). Follow-up PR needed once the tag exists. Claude-Session: https://claude.ai/code/session_0143Nf4sXqnTp2Kx3LNbMvBA --- .../dependabot-auto-merge.properties.json | 6 ++ workflow-templates/dependabot-auto-merge.yml | 58 +++++++++---------- 2 files changed, 34 insertions(+), 30 deletions(-) create mode 100644 workflow-templates/dependabot-auto-merge.properties.json diff --git a/workflow-templates/dependabot-auto-merge.properties.json b/workflow-templates/dependabot-auto-merge.properties.json new file mode 100644 index 0000000..1c4fec3 --- /dev/null +++ b/workflow-templates/dependabot-auto-merge.properties.json @@ -0,0 +1,6 @@ +{ + "name": "Dependabot Auto-Merge", + "description": "Approves and auto-merges Dependabot PRs for patch and minor version updates once CI passes. Major-version bumps are left open for manual review. Requires can_approve_pull_request_reviews enabled for this repo.", + "iconName": "git-merge", + "categories": ["automation", "dependencies"] +} diff --git a/workflow-templates/dependabot-auto-merge.yml b/workflow-templates/dependabot-auto-merge.yml index 63c444f..24dad01 100644 --- a/workflow-templates/dependabot-auto-merge.yml +++ b/workflow-templates/dependabot-auto-merge.yml @@ -1,21 +1,33 @@ name: Dependabot Auto-Merge -# Safely auto-merges Dependabot PRs after CI passes. Scope is narrow: -# - Only runs when github.actor == 'dependabot[bot]' (not spoofable; -# GitHub sets this from the authenticated user). -# - Only auto-merges patch + minor updates; major-version bumps are -# left open for manual review. -# - Uses pull_request_target so the BASE-branch workflow runs, not -# the PR branch's — a PR modifying this file cannot bypass itself. -# - Never executes PR code; the only action taken is `gh pr merge -# --auto`, which is a GitHub-side API call. +# Caller stub for the reusable `dependabot-auto-merge` workflow. Approves +# and auto-merges Dependabot PRs for patch and minor version updates once +# CI passes; major-version bumps are left open for manual review. # -# `gh pr review --approve` satisfies branch-protection rules that -# require review. `--auto` means the merge only happens after all -# status checks pass; failing CI leaves the PR open indefinitely. +# Requires `can_approve_pull_request_reviews: true` in this repo's Actions +# workflow permissions (Settings -> Actions -> General -> Workflow +# permissions) for the approval step to succeed. If unset, the approval +# degrades to a visible ::warning:: instead of blocking the merge outright +# (see smartwatermelon/github-workflows#87). # -# See playbook at -# smartwatermelon/github-workflows/docs/plans/2026-04-18-v2-rollout-playbook.md +# Do NOT add `secrets: inherit` here. This workflow needs no secrets +# beyond the ambient GITHUB_TOKEN it mints itself. `secrets: inherit` +# would hand every repo secret (deploy keys, CLAUDE_CODE_OAUTH_TOKEN, +# etc.) to a job evaluating externally-authored PR content under +# pull_request_target -- see the reusable workflow's own header comment +# and smartwatermelon/github-workflows#64 for the full reasoning. +# +# Do NOT add `actions/checkout` to this file either -- same reasoning, +# this file uses pull_request_target and the no-checkout property is +# its core safety invariant. +# +# TEMPORARY: pinned to the smartwatermelon/github-workflows commit SHA +# below because the dependabot-auto-merge-v1 tag does not exist yet -- +# it is created ~1 minute after that repo's PR #96 merges (matching this +# fleet's established tag/release convention). Follow-up: once the tag +# exists, repoint this stub at +# @dependabot-auto-merge-v1 (or a pinned @dependabot-auto-merge-v1.0.0) +# and remove this comment block. on: pull_request_target: @@ -26,19 +38,5 @@ permissions: pull-requests: write jobs: - auto-merge: - if: github.actor == 'dependabot[bot]' - runs-on: ubuntu-latest - steps: - - name: Fetch Dependabot metadata - id: metadata - uses: dependabot/fetch-metadata@v2 - - - name: Approve and enable auto-merge (patch/minor only) - if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' - env: - PR_URL: ${{ github.event.pull_request.html_url }} - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh pr review --approve "$PR_URL" - gh pr merge --auto --squash --delete-branch "$PR_URL" + dependabot-auto-merge: + uses: smartwatermelon/github-workflows/.github/workflows/dependabot-auto-merge.yml@ad3f0ec080ad5b119f2359bf42de6623c4730544 # TODO: repoint to @dependabot-auto-merge-v1 once cut From 1cfb88f5f1fcf25ce32a3ab998b528fb76d43854 Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 7 Aug 2026 16:18:37 -0700 Subject: [PATCH 2/2] chore(workflow-templates): repoint dependabot-auto-merge stub to cut tag Mirrors smartwatermelon/.github#11: the reusable workflow's dependabot-auto-merge-v1.0.0 tag (and floating dependabot-auto-merge-v1) are now cut in smartwatermelon/github-workflows following #96's merge. Replace the temporary branch-tip SHA pin with the real floating tag, and document explicitly that floating (versus a stricter pin) is an accepted tradeoff for this template, plus note that the actor gate and merge-scope defaults now live entirely inside the reusable workflow, invisible from this caller stub. --- workflow-templates/dependabot-auto-merge.yml | 30 ++++++++++++++------ 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/workflow-templates/dependabot-auto-merge.yml b/workflow-templates/dependabot-auto-merge.yml index 24dad01..e38c04d 100644 --- a/workflow-templates/dependabot-auto-merge.yml +++ b/workflow-templates/dependabot-auto-merge.yml @@ -2,7 +2,14 @@ name: Dependabot Auto-Merge # Caller stub for the reusable `dependabot-auto-merge` workflow. Approves # and auto-merges Dependabot PRs for patch and minor version updates once -# CI passes; major-version bumps are left open for manual review. +# CI passes; major-version bumps are left open for manual review. This +# stub passes no `with:` inputs -- the reusable workflow declares no +# `inputs:` today, so every behavior (the dependabot[bot]-actor gate, the +# patch/minor scope, the squash-merge strategy) is governed entirely by +# its defaults. The actor gate in particular is NOT visible in this file +# -- it lives inside the reusable workflow itself; see +# smartwatermelon/github-workflows/.github/workflows/dependabot-auto-merge.yml +# to audit it directly. # # Requires `can_approve_pull_request_reviews: true` in this repo's Actions # workflow permissions (Settings -> Actions -> General -> Workflow @@ -21,13 +28,18 @@ name: Dependabot Auto-Merge # this file uses pull_request_target and the no-checkout property is # its core safety invariant. # -# TEMPORARY: pinned to the smartwatermelon/github-workflows commit SHA -# below because the dependabot-auto-merge-v1 tag does not exist yet -- -# it is created ~1 minute after that repo's PR #96 merges (matching this -# fleet's established tag/release convention). Follow-up: once the tag -# exists, repoint this stub at -# @dependabot-auto-merge-v1 (or a pinned @dependabot-auto-merge-v1.0.0) -# and remove this comment block. +# Pinned to the floating `dependabot-auto-merge-v1` tag (not a fixed +# commit SHA), a deliberate, accepted tradeoff for this template -- not +# an oversight. This workflow runs under pull_request_target with +# contents:write / pull-requests:write, so a floating tag does put trust +# in whoever can push tags to smartwatermelon/github-workflows (today: +# repo owner only) to never move it to something malicious or broken. +# In exchange, bug fixes and hardening land fleet-wide automatically, +# matching how claude-blocking-review.yml@v3 already behaves -- the +# same tradeoff this fleet has already made and lived with for the +# review gate, extended here to the merge-automation workflow. Repos +# that want a stricter, audited pin instead of this default can repoint +# their own copy at `@dependabot-auto-merge-v1.0.0`. on: pull_request_target: @@ -39,4 +51,4 @@ permissions: jobs: dependabot-auto-merge: - uses: smartwatermelon/github-workflows/.github/workflows/dependabot-auto-merge.yml@ad3f0ec080ad5b119f2359bf42de6623c4730544 # TODO: repoint to @dependabot-auto-merge-v1 once cut + uses: smartwatermelon/github-workflows/.github/workflows/dependabot-auto-merge.yml@dependabot-auto-merge-v1