This repository was archived by the owner on Aug 20, 2026. It is now read-only.
feat: carry constructs in the flat form as additive construct-boundary markers #37
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # This repo has no sibling ExaDev package of its own to depend on, so every Dependabot PR here is a third-party dependency: auto-merge fires only for a minor or patch bump (never major, which still opens a PR for manual review), and only once dependabot.yml's own 7-day cooldown has let Dependabot propose it in the first place. Auto-merge is enforced by main's own CI actually passing on the PR's head commit -- this workflow only requests the merge, GitHub itself withholds it until checks conclude. The merge step authenticates via a GitHub App installation token rather than GITHUB_TOKEN specifically so the resulting push cascades into ci.yml/release, since GitHub does not let GITHUB_TOKEN-authenticated pushes trigger further workflow runs. | |
| on: | |
| # pull_request_target, not pull_request -- a workflow run triggered by dependabot[bot]'s own pull_request | |
| # event gets NO secret access at all (a hard GitHub Actions security restriction against a compromised | |
| # dependency update exfiltrating secrets), so secrets.AUTOMERGE_APP_PRIVATE_KEY would resolve empty | |
| # regardless of how correctly the secret itself is configured. pull_request_target runs using the base | |
| # branch's own workflow file and normal secret access instead. Safe here specifically because this job | |
| # never checks out or executes the PR's own code -- it only calls the GitHub API (fetch-metadata, gh pr | |
| # merge), which is exactly the case pull_request_target's own security guidance calls out as safe. | |
| pull_request_target: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| if: github.actor == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v2 | |
| with: | |
| github-token: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Generate a token for the merge | |
| id: app-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: "4473709" | |
| private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }} | |
| - name: Enable auto-merge | |
| if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch' | |
| run: gh pr merge --auto --rebase "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} |