• X
• Mastodon
• Reddit
• LinkedIn

tests/ci/dependabot-automerge-contract.test.ts > dependabot automerge contract > denylists native audio, model, and windowing crates

Stack Traces | 0.00113s run time

AssertionError: expected null not to be null
 ❯ tests/ci/dependabot-automerge-contract.test.ts:40:26

tests/ci/dependabot-automerge-contract.test.ts > dependabot automerge contract > keeps top-level permissions read-only

Stack Traces | 0.00127s run time

AssertionError: expected 'name: Dependabot auto-merge\n\n# Offi…' to match /permissions:\n  contents: read/

- Expected:
/permissions:\n  contents: read/

+ Received:
"name: Dependabot auto-merge

# Official pattern: pull_request_target so GITHUB_TOKEN has write access on
# Dependabot PRs. Never checkout or execute PR code in this workflow.
# Safety model:
# - Dependabot cooldown delays version-update PRs (supply-chain window)
# - Security updates bypass cooldown and auto-merge ASAP
# - CI/required checks still gate the actual merge when configured
on:
  pull_request_target:

permissions: {}

concurrency:
  group: dependabot-automerge-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  automerge:
    name: Enable auto-merge
    if: >
      github.event.pull_request.user.login == 'dependabot[bot]'
      && github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Dependabot metadata
        id: meta
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          alert-lookup: true

      - name: Enable auto-merge for safe updates
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_URL: ${{ github.event.pull_request.html_url }}
          DEP_NAMES: ${{ steps.meta.outputs.dependency-names }}
          PKG_ECOSYSTEM: ${{ steps.meta.outputs.package-ecosystem }}
          UPDATE_TYPE: ${{ steps.meta.outputs.update-type }}
          DEP_TYPE: ${{ steps.meta.outputs.dependency-type }}
          ALERT_STATE: ${{ steps.meta.outputs.alert-state }}
        run: |
          set -euo pipefail
          # Release/review tooling stays manual even when patch/minor.
          deny='googleapis/release-please-action dependabot/fetch-metadata'
          for blocked in $deny; do
            case \",${DEP_NAMES},\" in
              *\",${blocked},\"*)
                echo \"skip auto-merge (denylist): $blocked\"
                exit 0
                ;;
            esac
          done

          eco=\"${PKG_ECOSYSTEM}\"
          ut=\"${UPDATE_TYPE}\"
          dt=\"${DEP_TYPE}\"
          alert=\"${ALERT_STATE}\"

          eligible=false
          reason=\"\"

          # Security updates: always auto-merge (cooldown does not apply to them).
          if [ \"$alert\" = \"OPEN\" ] || [ \"$alert\" = \"FIXED\" ]; then
            eligible=true
            reason=\"security-update\"
          fi

          # Patch updates after cooldown window.
          if [ \"$ut\" = \"version-update:semver-patch\" ]; then
            eligible=true
            reason=\"semver-patch\"
          fi

          # github-actions non-major (covers SHA pin bumps with empty update-type).
          if [ \"$eco\" = \"github-actions\" ] || [ \"$eco\" = \"github_actions\" ]; then
            if [ \"$ut\" != \"version-update:semver-major\" ]; then
              eligible=true
              reason=\"github-actions-non-major\"
            fi
          fi

          # Minor of non-production / indirect / development deps.
          # Production minors stay manual (primary npm supply-chain surface).
          if [ \"$ut\" = \"version-update:semver-minor\" ] && [ \"$dt\" != \"direct:production\" ]; then
            eligible=true
            reason=\"minor-non-production\"
          fi

          if [ \"$eligible\" != true ]; then
            echo \"skip auto-merge: ecosystem=$eco update-type=$ut dependency-type=$dt alert=$alert names=$DEP_NAMES\"
            exit 0
          fi

          echo \"enable auto-merge ($reason): ecosystem=$eco update-type=$ut dependency-type=$dt alert=$alert names=$DEP_NAMES\"
          gh pr merge --auto --squash \"$PR_URL\"
"

 ❯ tests/ci/dependabot-automerge-contract.test.ts:60:22

tests/ci/dependabot-automerge-contract.test.ts > dependabot automerge contract > auto-merge is limited to semver patch and minor updates

Stack Traces | 0.00809s run time

AssertionError: expected [ 'version-update:semver-patch', …(2) ] to deeply equal [ 'version-update:semver-patch', …(1) ]

- Expected
+ Received

  [
    "version-update:semver-patch",
+   "version-update:semver-major",
    "version-update:semver-minor",
  ]

 ❯ tests/ci/dependabot-automerge-contract.test.ts:32:58