diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a2dc6e6..3237254 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,7 +10,7 @@ updates: directory: "/" open-pull-requests-limit: 2 schedule: - interval: "monthly" + interval: "daily" cooldown: default-days: 7 commit-message: @@ -20,6 +20,6 @@ updates: - package-ecosystem: "pip" directory: "/" # Location of package manifests schedule: - interval: "monthly" + interval: "daily" cooldown: default-days: 7 \ No newline at end of file diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml new file mode 100644 index 0000000..d9cf8f1 --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yaml @@ -0,0 +1,37 @@ +name: Auto-merge Dependabot PRs + +on: + pull_request: + types: + - opened + - reopened + - synchronize + - ready_for_review + - labeled + +jobs: + enable-automerge: + # Only run on Dependabot PRs + if: github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + + steps: + - name: Fetch Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 #v3.0.0 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Auto-approve Dependabot PR + uses: hmarr/auto-approve-action@8f929096a962e83ccdfa8afcf855f39f12d4dac7 # v4 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Enable auto-merge for Dependabot PRs + run: gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index c01344c..f734251 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -61,6 +61,9 @@ jobs: coverage: runs-on: ubuntu-latest + permissions: + checks: write + pull-requests: write if: github.repository == 'NHSDigital/mesh-client' steps: - name: checkout @@ -340,4 +343,38 @@ jobs: if [[ "${INSTALLED_VERSION}" != "${RELEASE_VERSION}" ]]; then echo "${INSTALLED_VERSION} != ${RELEASE_VERSION}" exit 1 - fi \ No newline at end of file + fi + + slack-notification: + runs-on: ubuntu-latest + needs: + - coverage + - lint + - tox + if: ${{ always() && github.repository == 'NHSDigital/mesh-client' && github.actor == 'dependabot[bot]' && contains(needs.*.result, 'failure') }} + steps: + - name: Slack Notification + uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a + with: + webhook: ${{ secrets.DEPENDABOT_SLACK_WEBHOOK_URL }} + webhook-type: incoming-webhook + payload: | + { + "blocks": [ + { + "type": "header", + "text": { + "type": "plain_text", + "text": ":alarm: DEPENDABOT PR FAILED :alarm:", + "emoji": true + } + }, + { + "type": "section", + "text": { + "type": "mrkdwn", + "text": "Checks failed for ${{ github.repository }}:${{ github.ref }} in " + } + } + ] + } \ No newline at end of file