Bump actions/dependency-review-action from 4.9.0 to 5.0.0 #35
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot reviewer | |
| # Fires whenever Dependabot opens, updates, or reopens a PR targeting main. | |
| # pull_request_target runs in the context of the base branch, which gives the | |
| # GITHUB_TOKEN enough permission to approve and merge without extra secrets. | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| branches: ["main"] | |
| # One run per PR at a time. We let the current run finish so an in-progress | |
| # squash merge isn't interrupted mid-flight. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| # Minimum permissions needed: | |
| # - pull-requests: approve and comment on PRs | |
| # - contents: enable auto-merge (writes to the merge queue) | |
| permissions: | |
| pull-requests: write | |
| contents: write | |
| env: | |
| # Opt into Node.js 24 now ahead of the June 2, 2026 forced migration. | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| review-dependabot-pr: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| # Skip entirely if this PR wasn't opened by Dependabot. | |
| if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }} | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - name: Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v3.1.0 | |
| # Decide once: allow github_actions (any semver) or patch/minor updates; | |
| # deny everything else. Major updates are filtered upstream by dependabot.yml, | |
| # so deny is a safety net for anything unexpected that slips through. | |
| - name: Decide | |
| id: decision | |
| run: | | |
| ecosystem="${{ steps.metadata.outputs.package-ecosystem }}" | |
| update_type="${{ steps.metadata.outputs.update-type }}" | |
| if [[ "$ecosystem" == "github_actions" ]] || \ | |
| [[ "$update_type" == "version-update:semver-patch" ]] || \ | |
| [[ "$update_type" == "version-update:semver-minor" ]]; then | |
| echo "action=allow" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "action=deny" >> "$GITHUB_OUTPUT" | |
| fi | |
| # --auto queues the merge so all required branch protection checks must | |
| # pass first (e.g. dependency-review) before the merge goes through. | |
| # Note: GITHUB_TOKEN cannot approve PRs (GitHub security policy), so we | |
| # skip approval and rely on branch protection checks via --auto. | |
| - name: Allow — merge | |
| if: steps.decision.outputs.action == 'allow' | |
| run: | | |
| gh pr merge "$PR_URL" --squash --auto | |
| - name: Deny — unexpected update | |
| if: steps.decision.outputs.action == 'deny' | |
| run: | | |
| gh pr close "$PR_URL" --comment "Auto-closed: ecosystem \`${{ steps.metadata.outputs.package-ecosystem }}\` / update-type \`${{ steps.metadata.outputs.update-type }}\` did not match any allow-list rule. Check dependabot.yml if this is unexpected." |