diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5a5dc33..66bd500 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,7 +6,7 @@ updates: interval: "weekly" assignees: - "eschaar" - open-pull-requests-limit: 10 + open-pull-requests-limit: 5 labels: - "dependencies" - "python" @@ -23,7 +23,7 @@ updates: - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "weekly" + interval: "daily" assignees: - "eschaar" open-pull-requests-limit: 5 diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index a639a05..68e2486 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -21,7 +21,7 @@ jobs: steps: - name: Fetch Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v2 + uses: dependabot/fetch-metadata@v3 with: github-token: ${{ secrets.GITHUB_TOKEN }} @@ -51,7 +51,7 @@ jobs: - name: Approve eligible PR if: steps.decision.outputs.should_automerge == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | @@ -63,9 +63,37 @@ jobs: body: "Auto-approved for safe Dependabot update policy." }) + - name: Update branch for eligible PR + if: steps.decision.outputs.should_automerge == 'true' + uses: actions/github-script@v9 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + script: | + // Intentional strategy: + // - Always request an update for eligible PRs instead of pre-checking merge state. + // - GitHub may report transient/unknown merge state during event handling. + // - updateBranch is idempotent; if already current, GitHub returns a benign 422/no-op. + // This keeps automerge flow deterministic without relying on flaky preconditions. + try { + await github.rest.pulls.updateBranch({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: context.payload.pull_request.number + }) + core.info("Requested branch update from base branch.") + } catch (error) { + const msg = String(error.message || "") + if (error.status === 422 || msg.includes("not behind")) { + // Expected no-op path when branch is already up to date. + core.info("Branch already up to date; continuing.") + } else { + core.setFailed("Could not update branch before automerge. " + msg) + } + } + - name: Enable auto-merge for eligible PR if: steps.decision.outputs.should_automerge == 'true' - uses: actions/github-script@v7 + uses: actions/github-script@v9 with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6ac0f2f..7912aae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,9 +26,10 @@ jobs: steps: - name: Generate app token id: app-token - uses: actions/create-github-app-token@v2 + uses: actions/create-github-app-token@v3 with: - app-id: ${{ secrets.APP_ID }} + # v3 requires the GitHub App client ID. + client-id: ${{ secrets.APP_CLIENT_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} - name: Checkout repository metadata @@ -50,8 +51,15 @@ jobs: exit 0 fi - if [[ "$manifest_version" != "$latest_tag" ]]; then - echo "ERROR: .release-please-manifest.json is stale." + if [[ ! "$manifest_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "ERROR: invalid .release-please-manifest.json version: $manifest_version" + exit 1 + fi + + # A merged release-please PR can make manifest_version temporarily newer than latest_tag. + # That state is valid; only fail if manifest_version is behind the newest existing tag. + if [[ "$(printf '%s\n%s\n' "$latest_tag" "$manifest_version" | sort -V | tail -n 1)" == "$latest_tag" && "$manifest_version" != "$latest_tag" ]]; then + echo "ERROR: .release-please-manifest.json is stale (behind latest tag)." echo "manifest version: $manifest_version" echo "latest git tag: $latest_tag" echo "Update .release-please-manifest.json before running release orchestration." diff --git a/CHANGELOG.md b/CHANGELOG.md index 8125714..7aa3e20 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,12 +4,23 @@ ## [2.0.3](https://github.com/eschaar/vstack/compare/2.0.2...2.0.3) (2026-04-28) +### Maintenance + +- **ci:** harden release workflows and normalize changelog ([5a38709](https://github.com/eschaar/vstack/commit/5a387091dcea8dc7545bda5430fd02aee88ac0af)) +- **ci:** restructure pipeline with release-please and GitHub App token ([8c06090](https://github.com/eschaar/vstack/commit/8c060906ae7d8a662ff1e772fa531484eafb1067)) +- **ci:** restructure pipeline with release-please and GitHub App token ([#30](https://github.com/eschaar/vstack/issues/30)) ([0008127](https://github.com/eschaar/vstack/commit/0008127fafbf261fbbf6363fe9a4eb7769edfe83)) + +## [2.0.2](https://github.com/eschaar/vstack/compare/2.0.1...2.0.2) (2026-04-27) + +### Maintenance + +- **ci:** bump trufflesecurity/trufflehog from 3.94.3 to 3.95.2 ([#25](https://github.com/eschaar/vstack/issues/25)) ([5724dbe](https://github.com/eschaar/vstack/commit/5724dbe605523da2c90a4f143fa8c4a92322adf4)) + +## [2.0.1](https://github.com/eschaar/vstack/compare/2.0.0...2.0.1) (2026-04-27) ### Maintenance -* **ci:** harden release workflows and normalize changelog ([5a38709](https://github.com/eschaar/vstack/commit/5a387091dcea8dc7545bda5430fd02aee88ac0af)) -* **ci:** restructure pipeline with release-please and GitHub App token ([8c06090](https://github.com/eschaar/vstack/commit/8c060906ae7d8a662ff1e772fa531484eafb1067)) -* **ci:** restructure pipeline with release-please and GitHub App token ([#30](https://github.com/eschaar/vstack/issues/30)) ([0008127](https://github.com/eschaar/vstack/commit/0008127fafbf261fbbf6363fe9a4eb7769edfe83)) +- **ci:** bump actions/download-artifact from 7 to 8 ([#26](https://github.com/eschaar/vstack/issues/26)) ([24d5a58](https://github.com/eschaar/vstack/commit/24d5a585c37fe8097de41863e0085917e81a376f)) ## 2.0.0 (2026-04-26)