diff --git a/.github/workflows/automerge-dependabot.yml b/.github/workflows/automerge-dependabot.yml deleted file mode 100644 index 86d24bc..0000000 --- a/.github/workflows/automerge-dependabot.yml +++ /dev/null @@ -1,72 +0,0 @@ -# Enables auto-merge (squash) on Dependabot PRs and any PR labelled "automerge". -# Draft PRs are skipped. Small updates (patch and minor) auto-merge on any -# ecosystem. Major updates only auto-merge for GitHub Actions, where CI runs the -# action itself so a breaking bump goes red; major application-dependency bumps -# (npm, pip and the like) are held for manual review, because CI can pass while -# runtime behaviour breaks. CI must still pass before any merge lands. -# -# Branch deletion for merges the token could not clean up is handled by the -# scheduled Repo maintenance workflow. See update-pr-branches.yml for the detail. - -name: Auto-merge Dependabot - -on: - pull_request_target: - types: [opened, reopened, synchronize, ready_for_review, labeled] - -permissions: - contents: write - pull-requests: write - -jobs: - enable-automerge: - name: Auto-merge safe Dependabot PRs - runs-on: ubuntu-latest - - steps: - - name: Fetch Dependabot metadata - id: meta - if: github.event.pull_request.user.login == 'dependabot[bot]' - uses: dependabot/fetch-metadata@v2 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - - - name: Enable auto-merge for eligible PRs - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_URL: ${{ github.event.pull_request.html_url }} - PR_IS_DRAFT: ${{ github.event.pull_request.draft }} - PR_AUTHOR: ${{ github.event.pull_request.user.login }} - PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }} - UPDATE_TYPE: ${{ steps.meta.outputs.update-type }} - ECOSYSTEM: ${{ steps.meta.outputs.package-ecosystem }} - run: | - # Never auto-merge drafts - they are explicitly not ready - if [ "$PR_IS_DRAFT" = "true" ]; then - echo "Draft PR - skipping auto-merge setup" - exit 0 - fi - - # Non-Dependabot PRs opt in with the automerge label - if [ "$PR_AUTHOR" != "dependabot[bot]" ]; then - if echo "$PR_LABELS" | grep -Eq '(^|,)automerge(,|$)'; then - gh pr merge --auto --squash --delete-branch "$PR_URL" - else - echo "Auto-merge not enabled - add the automerge label for non-Dependabot PRs" - fi - exit 0 - fi - - # Dependabot: hold major bumps for application dependencies (anything - # that is not GitHub Actions), auto-merge everything else. - if [ "$UPDATE_TYPE" = "version-update:semver-major" ]; then - case "$ECOSYSTEM" in - github_actions|github-actions) - echo "Major GitHub Actions bump - CI runs the action, enabling auto-merge" ;; - *) - echo "Holding major $ECOSYSTEM bump for manual review" - exit 0 ;; - esac - fi - - gh pr merge --auto --squash --delete-branch "$PR_URL" diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml deleted file mode 100644 index 1e94097..0000000 --- a/.github/workflows/stale.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: Stale - -on: - schedule: - # I run this daily at 01:00 UTC to keep the issue tracker tidy without - # spamming contributors during working hours. - - cron: '0 1 * * *' - -jobs: - stale: - runs-on: ubuntu-latest - permissions: - issues: write - pull-requests: write - - steps: - - uses: actions/stale@v9 - with: - stale-issue-message: > - This issue has had no activity for 60 days and has been marked as - stale. It will be closed in 14 days unless there is new activity. - If this is still relevant, please leave a comment or remove the - stale label. - close-issue-message: > - This issue was closed automatically after 14 days of inactivity - following the stale label. Feel free to reopen it if the problem - persists. - stale-pr-message: > - This pull request has had no activity for 60 days and has been - marked as stale. It will be closed in 14 days unless there is new - activity. - close-pr-message: > - This pull request was closed automatically after 14 days of - inactivity following the stale label. - days-before-stale: 60 - days-before-close: 14 - stale-issue-label: stale - stale-pr-label: stale - exempt-issue-labels: pinned,security,in-progress - exempt-pr-labels: pinned,security,in-progress diff --git a/.github/workflows/update-pr-branches.yml b/.github/workflows/update-pr-branches.yml deleted file mode 100644 index 1b15198..0000000 --- a/.github/workflows/update-pr-branches.yml +++ /dev/null @@ -1,49 +0,0 @@ -# Deletes merged PR branches that the merge itself failed to clean up. -# -# GitHub does not trigger other workflows' push or pull_request events for actions -# performed with a workflow's own GITHUB_TOKEN (anti-recursion safeguard), so the -# automerge job's squash-merge commits do not reliably fire this on push: main. A -# schedule trigger does not depend on what authored the previous event, so it is -# used as the reliable path; deleting an already-merged branch never pushes a commit -# to an open PR, so it cannot trigger further CI. - -name: Repo maintenance - -on: - push: - branches: [main] - schedule: - # Every 2 hours - cheap safety net for branch deletion only - - cron: "0 */2 * * *" - workflow_dispatch: {} - -permissions: - contents: write - pull-requests: write - -jobs: - maintain-branches: - runs-on: ubuntu-latest - steps: - - name: Delete head branches of merged PRs that still exist - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - REPO: ${{ github.repository }} - run: | - # Recently merged PRs - their head branch should have been deleted at - # merge time, but the GITHUB_TOKEN restriction above means it often did not - merged_branches=$(gh api "repos/$REPO/pulls?state=closed&sort=updated&direction=desc&per_page=30" \ - --jq '[.[] | select(.merged_at != null and .head.repo.full_name == "'"$REPO"'") | .head.ref] | .[]') - - if [ -z "$merged_branches" ]; then - echo "No recently merged PRs found" - exit 0 - fi - - while read -r branch; do - [ "$branch" = "main" ] && continue - if gh api "repos/$REPO/branches/$branch" >/dev/null 2>&1; then - echo "Deleting stale merged branch: $branch" - gh api -X DELETE "repos/$REPO/git/refs/heads/$branch" || echo "Failed to delete $branch - may already be gone" - fi - done <<< "$merged_branches"