deps: bump actions/setup-dotnet from 5.3.0 to 5.4.0 in the actions group #24
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Setup instructions: | |
| # 1) Required workflow/job permissions in this file: | |
| # - pull-requests: write | |
| # - contents: write | |
| # 2) Optional repository secret for workflow-file PR auto-merge: | |
| # - DEPENDABOT_AUTOMERGE_TOKEN | |
| # Classic PAT scopes: repo, workflow. | |
| # Fine-grained PAT repo permissions: Pull requests (Read and write), | |
| # Contents (Read and write), Workflows (Read and write). | |
| # 3) Token selection used by gh commands: | |
| # - If DEPENDABOT_AUTOMERGE_TOKEN is set, steps use it. | |
| # - Otherwise steps use the default Actions GITHUB_TOKEN. | |
| # 4) Why the optional token matters: | |
| # - PRs that modify .github/workflows/* may fail merge/auto-merge without | |
| # workflows-capable token permissions. | |
| name: Dependabot Auto-Merge | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: [opened, reopened, synchronize] | |
| permissions: | |
| pull-requests: write | |
| contents: write | |
| jobs: | |
| Resolve: | |
| runs-on: ubuntu-latest | |
| if: > | |
| github.event.pull_request.user.login == 'dependabot[bot]' && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| github.event.pull_request.base.ref == 'main' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| - name: Checkout PR head | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: ${{ github.event.pull_request.head.ref }} | |
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |
| fetch-depth: 0 | |
| - name: Resolve conflicts for Dependabot PRs | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CUSTOM_GH_TOKEN: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }} | |
| EVENT_PR_NUMBER: ${{ github.event.pull_request.number || '' }} | |
| EVENT_HEAD_REF: ${{ github.event.pull_request.head.ref || '' }} | |
| EVENT_BASE_REF: ${{ github.event.pull_request.base.ref || '' }} | |
| run: | | |
| set -euo pipefail | |
| if [ -n "${CUSTOM_GH_TOKEN}" ]; then | |
| GH_TOKEN="${CUSTOM_GH_TOKEN}" | |
| export GH_TOKEN | |
| echo "Using DEPENDABOT_AUTOMERGE_TOKEN for gh commands." | |
| else | |
| echo "Using default GITHUB_TOKEN for gh commands." | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| if [ -z "${EVENT_PR_NUMBER}" ] || [ -z "${EVENT_HEAD_REF}" ] || [ -z "${EVENT_BASE_REF}" ]; then | |
| echo "Missing pull_request context for Dependabot auto-resolve." | |
| exit 1 | |
| fi | |
| echo "Resolving conflicts for dependabot PR #${EVENT_PR_NUMBER} (${EVENT_HEAD_REF} <- ${EVENT_BASE_REF})" | |
| git fetch origin "${EVENT_BASE_REF}" "${EVENT_HEAD_REF}" | |
| git checkout -B "${EVENT_HEAD_REF}" "origin/${EVENT_HEAD_REF}" | |
| set +e | |
| git merge --no-edit "origin/${EVENT_BASE_REF}" | |
| merge_exit=$? | |
| set -e | |
| if [ "$merge_exit" -eq 0 ]; then | |
| echo "Merged ${EVENT_BASE_REF} into ${EVENT_HEAD_REF} cleanly, or already up to date." | |
| git push origin "HEAD:${EVENT_HEAD_REF}" | |
| exit 0 | |
| fi | |
| mapfile -t conflict_files < <(git diff --name-only --diff-filter=U) | |
| if [ "${#conflict_files[@]}" -eq 0 ]; then | |
| echo "Merge failed for PR #${EVENT_PR_NUMBER} but no conflicted files were detected." | |
| git merge --abort || true | |
| exit 1 | |
| fi | |
| for file in "${conflict_files[@]}"; do | |
| git checkout --theirs -- "$file" | |
| git add "$file" | |
| done | |
| git commit -m "chore: auto-resolve conflicts from ${EVENT_BASE_REF} for dependabot PR #${EVENT_PR_NUMBER}" | |
| git push origin "HEAD:${EVENT_HEAD_REF}" | |
| Approve: | |
| runs-on: ubuntu-latest | |
| needs: [Resolve] | |
| if: needs.Resolve.result == 'success' | |
| permissions: | |
| pull-requests: write | |
| steps: | |
| - name: Approve Dependabot PRs | |
| shell: bash | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CUSTOM_GH_TOKEN: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url || '' }} | |
| run: | | |
| set -euo pipefail | |
| if [ -n "${CUSTOM_GH_TOKEN}" ]; then | |
| GH_TOKEN="${CUSTOM_GH_TOKEN}" | |
| export GH_TOKEN | |
| echo "Using DEPENDABOT_AUTOMERGE_TOKEN for gh commands." | |
| else | |
| echo "Using default GITHUB_TOKEN for gh commands." | |
| fi | |
| if [ -z "${PR_URL}" ]; then | |
| echo "No pull_request URL found in event payload." | |
| exit 1 | |
| fi | |
| if [ "$(gh pr view "${PR_URL}" --json reviewDecision -q '.reviewDecision')" != "APPROVED" ]; then | |
| gh pr review --approve "${PR_URL}" | |
| else | |
| echo "PR already approved: ${PR_URL}" | |
| fi | |
| Merge: | |
| runs-on: ubuntu-latest | |
| needs: [Approve] | |
| if: needs.Approve.result == 'success' | |
| permissions: | |
| pull-requests: write | |
| contents: write | |
| steps: | |
| - name: Dependabot metadata | |
| if: github.event_name == 'pull_request' | |
| id: dependabot-metadata | |
| uses: dependabot/fetch-metadata@v3 | |
| - name: Squash merge Dependabot PRs | |
| shell: bash | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url || '' }} | |
| UPDATE_TYPE: ${{ steps.dependabot-metadata.outputs.update-type || '' }} | |
| GH_TOKEN: ${{secrets.GITHUB_TOKEN}} | |
| CUSTOM_GH_TOKEN: ${{ secrets.DEPENDABOT_AUTOMERGE_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| if [ -n "${CUSTOM_GH_TOKEN}" ]; then | |
| GH_TOKEN="${CUSTOM_GH_TOKEN}" | |
| export GH_TOKEN | |
| echo "Using DEPENDABOT_AUTOMERGE_TOKEN for gh commands." | |
| else | |
| echo "Using default GITHUB_TOKEN for gh commands." | |
| fi | |
| if [ -z "${PR_URL}" ]; then | |
| echo "No pull_request URL found in event payload." | |
| exit 1 | |
| fi | |
| set +e | |
| merge_output="$(gh pr merge --squash "${PR_URL}" 2>&1)" | |
| merge_status=$? | |
| set -e | |
| if [ "$merge_status" -eq 0 ]; then | |
| echo "$merge_output" | |
| elif echo "$merge_output" | grep -Fq "without \`workflows\` permission"; then | |
| echo "$merge_output" | |
| echo "Skipping ${PR_URL} due to missing workflows permission for workflow-file changes." | |
| elif echo "$merge_output" | grep -Fq "already merged"; then | |
| echo "PR already merged: ${PR_URL}" | |
| else | |
| echo "$merge_output" | |
| exit "$merge_status" | |
| fi |