diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ed729c0..cd4bf1d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,6 @@ version: 2 updates: - # Enable version updates for NuGet packages + # NuGet package dependencies - package-ecosystem: "nuget" directory: "/" schedule: @@ -13,17 +13,33 @@ updates: commit-message: prefix: "chore" include: "scope" - - # Enable version updates for GitHub Actions + # Group minor and patch updates together + groups: + minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + # GitHub Actions dependencies - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" - day: "monday" + day: "monday" time: "09:00" open-pull-requests-limit: 5 reviewers: - "BeingCiteable" commit-message: prefix: "ci" - include: "scope" \ No newline at end of file + include: "scope" + # Group minor and patch updates together + groups: + minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 2177022..21fbb57 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -4,7 +4,7 @@ This directory contains the GitHub Actions workflows for building, testing, rele ## 📋 Workflow Overview -**Simple and Clean:** Only 4 active workflows - no archived clutter, no legacy code. +**Simple and Clean:** Only 3 active workflows - no archived clutter, no legacy code. The CI/CD pipeline consists of three main workflows: @@ -265,15 +265,23 @@ Built into the **Build and Test** workflow: These tests run on **every build** before artifacts are created. -### Dependabot Auto-merge -**File:** `dependabot-automerge.yml` +### Dependabot (GitHub Feature) +**File:** `.github/dependabot.yml` -Automatically approves and merges: -- Minor version updates -- Patch version updates +Automatically monitors and updates dependencies: +- 📦 **NuGet packages** - Weekly on Mondays +- ⚙️ **GitHub Actions** - Weekly on Mondays +- 🔄 **Groups** minor and patch updates together +- 👤 Requests review from BeingCiteable +- ⚠️ Major updates require manual review -**Requires manual review:** -- Major version updates +**Setup Required:** +1. Go to **Settings** → **General** → **Pull Requests** +2. Enable "**Allow auto-merge**" +3. Dependabot will create grouped PRs for minor/patch updates +4. You can enable auto-merge on those PRs directly + +This replaces the need for a custom auto-merge workflow! --- @@ -464,18 +472,20 @@ dotnet nuget push *.nupkg \ ## 🎯 Workflow Summary -**Total Active Workflows:** 4 +**Total Active Workflows:** 3 | Workflow | Purpose | Trigger | Lines | |----------|---------|---------|-------| | `build-and-test.yml` | Multi-framework build & validation | Every commit | 232 | | `create-release.yml` | Create GitHub Release | Manual | 194 | | `publish-nuget.yml` | Publish to NuGet.org | On release | 230 | -| `dependabot-automerge.yml` | Auto-merge dependencies | Dependabot PR | 33 | -**Total:** 689 lines of clean, focused workflow code. +**Total:** 656 lines of clean, focused workflow code. + +**Additional Configuration:** +- `.github/dependabot.yml` - Dependency monitoring (uses GitHub's native features) -**Philosophy:** Simple, essential, maintainable. No archived workflows, no legacy code, no clutter. +**Philosophy:** Simple, essential, maintainable. No archived workflows, no legacy code, no clutter. Use GitHub's built-in features when possible. --- diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml deleted file mode 100644 index b863e08..0000000 --- a/.github/workflows/dependabot-automerge.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: Dependabot Auto-merge - -on: - pull_request_target: - types: [opened, synchronize, reopened] - -permissions: - contents: write - pull-requests: write - -jobs: - dependabot: - runs-on: ubuntu-latest - if: ${{ github.actor == 'dependabot[bot]' }} - steps: - - name: Dependabot metadata - id: metadata - uses: dependabot/fetch-metadata@v2 - with: - github-token: "${{ secrets.GITHUB_TOKEN }}" - - - name: Auto-approve minor and patch updates - if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major' }} - run: gh pr review --approve "$PR_URL" - env: - PR_URL: ${{github.event.pull_request.html_url}} - GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} - - - name: Auto-merge minor and patch updates - if: ${{ steps.metadata.outputs.update-type != 'version-update:semver-major' }} - run: gh pr merge --auto --merge "$PR_URL" - env: - PR_URL: ${{github.event.pull_request.html_url}} - GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} \ No newline at end of file