From ccdf349df8f88a2f5468c4a81bfb9963e3fa7d50 Mon Sep 17 00:00:00 2001 From: Russ Rutledge Date: Thu, 10 Sep 2026 08:23:50 -0500 Subject: [PATCH] Add Dependabot auto-merge and verify-or-revert workflows Automate Dependabot dependency bumps end to end, gated on the post-merge "Publish to website" deploy that pushes generated content to the innersourcecommons.org repo. - dependabot-auto-merge.yml: auto-approve and enable auto-merge for patch and minor Dependabot bumps; hold major bumps for a human, since majors are what have broken the deploy before. - revert-bump-on-failed-deploy.yml: when the deploy fails on a bump commit, open a revert PR that mentions the learning-path maintainers and enable auto-merge on it (one approval still completes the revert). Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_018zv3SKYNduHEhVyNWLb3Xh --- .github/workflows/dependabot-auto-merge.yml | 38 ++++++++++++ .../revert-bump-on-failed-deploy.yml | 60 +++++++++++++++++++ 2 files changed, 98 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml create mode 100644 .github/workflows/revert-bump-on-failed-deploy.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 00000000..b140b2f9 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,38 @@ +name: Dependabot auto-merge + +# Auto-approves and enables auto-merge for Dependabot dependency bumps, scoped to +# patch and minor updates. Major bumps (e.g. asciidoctor 3 -> 4) are held for a +# human, because those are the ones that have broken the "Publish to website" +# deploy in the past. The companion "Revert bump on failed deploy" workflow is the +# safety net for a patch/minor bump that still breaks the deploy after it merges. +# +# Requires the repo setting "Allow auto-merge" to be enabled, and "Allow GitHub +# Actions to create and approve pull requests" (already on for this repo). + +on: pull_request_target + +permissions: + contents: write + pull-requests: write + +jobs: + auto-merge: + if: github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - name: Fetch Dependabot metadata + id: meta + uses: dependabot/fetch-metadata@v2 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Approve and enable auto-merge (patch/minor only) + if: > + steps.meta.outputs.update-type == 'version-update:semver-patch' || + steps.meta.outputs.update-type == 'version-update:semver-minor' + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh pr review --approve "$PR_URL" + gh pr merge --auto --squash "$PR_URL" diff --git a/.github/workflows/revert-bump-on-failed-deploy.yml b/.github/workflows/revert-bump-on-failed-deploy.yml new file mode 100644 index 00000000..2519add2 --- /dev/null +++ b/.github/workflows/revert-bump-on-failed-deploy.yml @@ -0,0 +1,60 @@ +name: Revert bump on failed deploy + +# Safety net for the Dependabot auto-merge flow. When "Publish to website" fails on +# a push to main whose commit is a Dependabot bump ("Bump ..."), this opens a PR +# that reverts that commit and @-mentions the maintainers. The revert PR is set to +# auto-merge, but branch protection still requires one approving review, so a +# maintainer clicks approve to complete the revert. That review is also the backstop +# against a false revert: a deploy can fail for a reason unrelated to the bump that +# happened to trigger the run, and the maintainer sees the failing run before +# approving. +# +# To make the revert fully hands-off (no human approval), a GitHub App token acting +# as a second identity could approve the revert PR; today the default token cannot +# approve a PR it opened itself. + +on: + workflow_run: + workflows: ["Publish to website"] + types: [completed] + +permissions: + contents: write + pull-requests: write + +jobs: + revert: + if: > + github.event.workflow_run.event == 'push' && + github.event.workflow_run.head_branch == 'main' && + github.event.workflow_run.conclusion == 'failure' && + startsWith(github.event.workflow_run.head_commit.message, 'Bump ') + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v7 + with: + fetch-depth: 0 + + - name: Revert the breaking bump and open a PR + env: + SHA: ${{ github.event.workflow_run.head_sha }} + TITLE: ${{ github.event.workflow_run.head_commit.message }} + RUN_URL: ${{ github.event.workflow_run.html_url }} + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + BRANCH="revert-deploy-${SHA:0:8}" + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git checkout -b "$BRANCH" + if ! git revert --no-edit "$SHA"; then + echo "::error::Revert of $SHA did not apply cleanly; a maintainer must revert by hand." + git revert --abort || true + exit 1 + fi + git push origin "$BRANCH" + BODY=$(printf '@InnerSourceCommons/learning-path the **Publish to website** deploy failed after this dependency bump merged to `main`, so it was reverted automatically.\n\nFailed run: %s\nReverted commit: %s\n\nThis revert PR has auto-merge enabled and needs one approving review to complete. Before approving, confirm the failing run was actually caused by this bump (a deploy can fail for an unrelated reason). Once the deploy is healthy again, Dependabot will re-open the bump on its next run.' "$RUN_URL" "$SHA") + gh pr create --base main --head "$BRANCH" \ + --title "Revert bump that broke the deploy: $TITLE" \ + --body "$BODY" + gh pr merge --auto --squash "$BRANCH" || true