docs: add mesh impact checklist to agent guidance #6124
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot Auto-merge | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| dependabot: | |
| name: Auto-merge Dependabot PRs | |
| runs-on: ubuntu-latest | |
| if: github.actor == 'dependabot[bot]' | |
| steps: | |
| - name: Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3 | |
| with: | |
| github-token: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Wait for checks to complete | |
| uses: lewagon/wait-on-check-action@369769072fe522a3a8a85c03c96af1e5242a1994 # v1.9.1 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| # "Quick Tests" retired with pr-tests.yml (its coverage was a strict | |
| # subset of "Test Suite"); "Documentation Build" moved into ci.yml. | |
| # | |
| # `Analyze` (CodeQL) and `ClamAV Scan` were missing here, and that was | |
| # not harmless: Dependabot's codeql-action bumps are *patch* updates, | |
| # so they qualify for auto-merge, and CodeQL is the one thing they can | |
| # break. #4519/#4521/#4531 each bumped a single codeql-action step, | |
| # leaving codeql.yml pinning two different versions, and every one of | |
| # them failed on Autobuild — while every check in this list stayed | |
| # green. With auto-merge enabled they would have merged themselves and | |
| # broken CodeQL on main. | |
| # | |
| # Deliberately NOT listed: `security/snyk` and `claude-review` (an | |
| # outage or a non-deterministic review would stall every bump), and | |
| # `Auto-merge Dependabot PRs` (this job — it would wait on itself). | |
| check-regexp: '(Build Check|Test Suite|Security Scan|Docker Build|Documentation Build|ClamAV Scan|Analyze).*' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| wait-interval: 30 | |
| allowed-conclusions: success,skipped,neutral | |
| - name: Enable auto-merge for patch updates | |
| if: | | |
| steps.metadata.outputs.update-type == 'version-update:semver-patch' | |
| run: | | |
| echo "Auto-merging patch update: ${{ steps.metadata.outputs.dependency-names }}" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Enable auto-merge for minor updates | |
| if: | | |
| steps.metadata.outputs.update-type == 'version-update:semver-minor' && | |
| steps.metadata.outputs.dependency-type == 'direct:development' | |
| run: | | |
| echo "Auto-merging minor dev dependency update: ${{ steps.metadata.outputs.dependency-names }}" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Comment on PR | |
| if: | | |
| steps.metadata.outputs.update-type == 'version-update:semver-major' || | |
| (steps.metadata.outputs.update-type == 'version-update:semver-minor' && steps.metadata.outputs.dependency-type != 'direct:development') | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | |
| with: | |
| script: | | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: '⚠️ This PR contains a **${{ steps.metadata.outputs.update-type }}** update and requires manual review before merging.' | |
| }) |