ci(NOJIRA-1234): extend bot PR automerge to smartling and aikido - #171
ci(NOJIRA-1234): extend bot PR automerge to smartling and aikido#171Jlougedo-TF wants to merge 4 commits into
Conversation
Gate on the PR author login instead of a single actor, so translation PRs from smartling-github-connector[bot] and security fixes from aikido-autofix[bot] are auto-approved and auto-merged alongside dependabot. Titles are not a reliable signal for these bots, so the allowlist keys off github.actor only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
This repo has no Smartling-managed content: the smartling-github-connector[bot] has never opened a PR here and there is no Smartling config. Narrow the allowlist to the bots that actually raise PRs in this repo. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A green CI run does not prove a transitive dependency bump is safe: the repo's own tests never exercise how the intermediate package uses the changed API. Approve as before, but only arm auto-merge when the diff looks routine. Held back for a human when any of these match: - the bot's title declares a major version upgrade - a JS manifest touches resolutions/overrides (a forced transitive pin) - go.mod gains a +incompatible major bump - more than 6 manifest dependency lines change at once - the lockfile rewrite exceeds 600 lines Validated against 13 real bot PRs: correctly holds xfiles#543 (docker v24->v25 +incompatible), blocks#3039 (major axios), renderer#1481 and mail-composer#400 (forced resolutions), and correctly passes the single direct minor bumps such as embed#760, pages#620 and purgatory#314. Also drops the checkout and 'apt-get install gh' steps: nothing read the working tree (gh is API-only) and gh ships on ubuntu-latest. All repos now hold a byte-identical file apart from the allowlist line. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assess risk first, then approve only when the diff looks routine. A risky PR now gets no approval at all, so it cannot satisfy the required-review count and a human has to sign it off - the label alone was advisory, since a bot approval already met the review requirement. Also close the stale-arming gap: a PR can open looking routine (approved, auto-merge armed) and then be force-pushed into something risky. On the risky path the workflow now calls 'gh pr merge --disable-auto' and dismisses its own earlier approval before labelling and commenting. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
Gate on the PR author login instead of a single actor, so translation PRs from smartling-github-connector[bot] and security fixes from aikido-autofix[bot] are auto-approved and auto-merged alongside dependabot.
Titles are not a reliable signal for these bots, so the allowlist keys off github.actor only.