my_api_client 1.3.1 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d7d3471ad8b1b1fe955f65dee427f4456055a1608abbd1a6a66159a9971db727
-  data.tar.gz: 9f3d5aa9a5f84b7b3185b3948e2608f104775fd1a9833e534fea1970dcc99d25
+  metadata.gz: 8c810e4644f4b3276f9be5b136b196040081204ffd2c1a4590d35f75f7267f37
+  data.tar.gz: a20a2ad006d18a8211ab056d760d9454f6883dcd6e4f88fcdcda38f6f9bb524b
 SHA512:
-  metadata.gz: 4b7240277aab4f9299fa362a5a7d60a33c8d0dc7a26f674164fea7ebd914655f18ad553a16d0a1516da9d02261d58248ec71c4596ce37ada569cd60ef7272ea5
-  data.tar.gz: d0460fffc5ca8d8c30db1b57be78c8e6ad28d4278d4c6cf5e79ef30f3681e9b63fbd2953abebdb80c100adacfcf0bc156643ef4bc03ca5d73f33203fc37a2d66
+  metadata.gz: 3c6a1873fb33961931afccaee071ad8c2f734c1bcf3d29937274eae92cac18727a881edb00cd02890a6e7d566d1e8168b12a5cf8c5b124ef61aff27a960e9a50
+  data.tar.gz: c78a1a59b9f50c89b4489a23fd6fb501727f4e412b184acf5ae9f8be6fe7d1a93a621f1620bc67a25b20193c7a9f766b9d0fdc9642b0e488d45c3a1eeca6b81a

data/.dockerignore

@@ -0,0 +1,8 @@
+.github
+.yardoc
+coverage
+tmp
+log
+vendor/bundle
+.bundle
+.rspec_status

data/.envrc.skeleton

@@ -1,2 +1 @@
 export GITHUB_ACCESS_TOKEN={GITHUB_ACCESS_TOKEN}
-export MY_API_ENDPOINT={API gateway endtpoint of "my_api" for integration testing}

data/.github/dependabot.yml

@@ -1,14 +1,20 @@
 version: 2
+# cooldown: defer version bumps until a release has aged, reducing the risk of
+# adopting a compromised or broken version right after publication. Longer for
+# higher-impact bumps (major > minor > patch).
 updates:
 - package-ecosystem: bundler
   directory: "/"
   schedule:
-    interval: daily
+    interval: weekly
     time: "08:00"
-    timezone: Japan
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
-  reviewers:
-  - ryz310
   assignees:
   - ryz310
   labels:
@@ -17,15 +23,132 @@ updates:
   - dependency-name: rubocop
     versions:
     - 1.9.0
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
+  open-pull-requests-limit: 10
+  assignees:
+  - ryz310
+  labels:
+  - dependabot
 - package-ecosystem: bundler
   directory: "/my_api"
   schedule:
-    interval: daily
+    interval: weekly
     time: "08:00"
-    timezone: Japan
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
-  reviewers:
+  assignees:
   - ryz310
+  labels:
+  - dependabot
+- package-ecosystem: bundler
+  directory: "/rails_app/rails_7.2"
+  schedule:
+    interval: weekly
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
+  open-pull-requests-limit: 10
+  assignees:
+  - ryz310
+  labels:
+  - dependabot
+- package-ecosystem: github-actions
+  directory: "/rails_app/rails_7.2"
+  schedule:
+    interval: weekly
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
+  open-pull-requests-limit: 10
+  assignees:
+  - ryz310
+  labels:
+  - dependabot
+- package-ecosystem: bundler
+  directory: "/rails_app/rails_8.0"
+  schedule:
+    interval: weekly
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
+  open-pull-requests-limit: 10
+  assignees:
+  - ryz310
+  labels:
+  - dependabot
+- package-ecosystem: github-actions
+  directory: "/rails_app/rails_8.0"
+  schedule:
+    interval: weekly
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
+  open-pull-requests-limit: 10
+  assignees:
+  - ryz310
+  labels:
+  - dependabot
+- package-ecosystem: bundler
+  directory: "/rails_app/rails_8.1"
+  schedule:
+    interval: weekly
+    day: monday
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
+  open-pull-requests-limit: 10
+  assignees:
+  - ryz310
+  labels:
+  - dependabot
+- package-ecosystem: github-actions
+  directory: "/rails_app/rails_8.1"
+  schedule:
+    interval: weekly
+    day: monday
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
+  open-pull-requests-limit: 10
   assignees:
   - ryz310
   labels:

data/.github/workflows/ci.yml

@@ -0,0 +1,348 @@
+name: CI
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build_gem:
+    name: build_on_ruby_${{ matrix.ruby_version }}_and_rails_${{ matrix.rails_version }}_${{ matrix.bundler_option.name }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby_version: ['3.3', '3.4', '4.0']
+        rails_version: ['7.2', '8.0', '8.1']
+        bundler_option:
+          - name: with_integrations
+            with: integrations
+            without: ""
+          - name: without_integrations
+            with: ""
+            without: integrations
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby ${{ matrix.ruby_version }}
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: ${{ matrix.ruby_version }}
+          bundler-cache: false
+
+      - name: Install Bundler 2.x
+        run: gem install bundler -v "~> 2.0"
+
+      - name: Configure Bundler options
+        env:
+          BUNDLE_WITH: ${{ matrix.bundler_option.with }}
+          BUNDLE_WITHOUT: ${{ matrix.bundler_option.without }}
+        run: |
+          if [ -n "${BUNDLE_WITH}" ]; then
+            bundle config set --local with "${BUNDLE_WITH}"
+          else
+            bundle config unset --local with || true
+          fi
+
+          if [ -n "${BUNDLE_WITHOUT}" ]; then
+            bundle config set --local without "${BUNDLE_WITHOUT}"
+          else
+            bundle config unset --local without || true
+          fi
+
+      - name: Use Rails ${{ matrix.rails_version }} appraisal
+        run: cp gemfiles/rails_${{ matrix.rails_version }}.gemfile Gemfile
+
+      - name: Update ActiveSupport
+        run: bundle update activesupport
+
+      - name: Execute RSpec
+        env:
+          SIMPLECOV_COMMAND_NAME: build_gem_ruby_${{ matrix.ruby_version }}_rails_${{ matrix.rails_version }}_${{ matrix.bundler_option.name }}
+        run: |
+          bundle exec rspec --format documentation \
+                            --color \
+                            --format RspecJunitFormatter
+
+      - name: Rake build
+        run: bundle exec rake build
+
+      - name: Prepare coverage artifact
+        if: ${{ always() && hashFiles('coverage/.resultset.json') != '' }}
+        run: cp coverage/.resultset.json coverage/resultset.json
+
+      - name: Upload coverage artifact
+        if: ${{ always() && hashFiles('coverage/resultset.json') != '' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: simplecov-resultset-ruby_${{ matrix.ruby_version }}-rails_${{ matrix.rails_version }}-${{ matrix.bundler_option.name }}
+          path: coverage/resultset.json
+
+  verify_generator:
+    name: verify_generator_on_ruby_${{ matrix.ruby_version }}_and_rails_${{ matrix.rails_version }}
+    runs-on: ubuntu-latest
+    env:
+      BUNDLE_PATH: vendor/bundle
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby_version: ['3.3', '3.4', '4.0']
+        rails_version: ['7.2', '8.0', '8.1']
+    defaults:
+      run:
+        working-directory: rails_app/rails_${{ matrix.rails_version }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby ${{ matrix.ruby_version }}
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: ${{ matrix.ruby_version }}
+          bundler-cache: false
+
+      - name: Install Bundler 2.x
+        run: gem install bundler -v "~> 2.0"
+
+      - name: Bundle install
+        run: bundle install
+
+      - name: Add compatibility symlink for libffi
+        run: |
+          if [ ! -e /usr/lib/x86_64-linux-gnu/libffi.so.6 ]; then
+            latest_libffi="$(find /usr/lib/x86_64-linux-gnu -maxdepth 1 -type f -name 'libffi.so.*.*.*' | sort -V | tail -n 1)"
+            if [ -n "${latest_libffi}" ]; then
+              sudo ln -s "${latest_libffi}" /usr/lib/x86_64-linux-gnu/libffi.so.6
+            fi
+          fi
+
+      - name: Generate new API client files
+        run: |
+          bin/rails g api_client path/to/resource \
+            get:path/to/resource \
+            post:path/to/resource \
+            --endpoint https://example.com/myapi
+
+      - name: Check generated API client files
+        run: |
+          test -e "app/api_clients/application_api_client.rb" && \
+          test -e "app/api_clients/path/to/resource_api_client.rb" && \
+          test -e "spec/api_clients/path/to/resource_api_client_spec.rb"
+
+      - name: Run rspec with the generated spec file
+        run: bundle exec rspec -f d spec/api_clients/path/to
+
+  integration_api:
+    name: integration_api_via_docker_compose
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Build and start my_api
+        run: docker compose up -d --build my_api
+
+      - name: Run integration specs against my_api
+        env:
+          MY_API_ENDPOINT: http://my_api:3000
+          SIMPLECOV_COMMAND_NAME: integration_api
+        run: |
+          docker compose run --rm test bash -lc "
+            bundle config set --local with integrations &&
+            bundle install &&
+            bundle exec rspec spec/integrations/api_clients
+          "
+
+      - name: Fix coverage directory ownership
+        if: ${{ always() && hashFiles('coverage/.resultset.json') != '' }}
+        run: sudo chown -R "$(id -u):$(id -g)" coverage
+
+      - name: Prepare coverage artifact
+        if: ${{ always() && hashFiles('coverage/.resultset.json') != '' }}
+        run: cp coverage/.resultset.json coverage/resultset.json
+
+      - name: Upload coverage artifact
+        if: ${{ always() && hashFiles('coverage/resultset.json') != '' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: simplecov-resultset-integration_api
+          path: coverage/resultset.json
+
+      - name: Show my_api logs when failed
+        if: ${{ failure() }}
+        run: docker compose logs my_api
+
+      - name: Shutdown compose services
+        if: ${{ always() }}
+        run: docker compose down --volumes --remove-orphans
+
+  my_api_request_specs:
+    name: my_api_request_specs_via_docker_compose
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Build and start my_api
+        run: docker compose up -d --build my_api
+
+      - name: Run my_api request specs
+        env:
+          SIMPLECOV_COMMAND_NAME: my_api_request_specs
+        run: docker compose run --rm my_api bundle exec rspec spec/requests
+
+      - name: Fix my_api coverage directory ownership
+        if: ${{ always() && hashFiles('my_api/coverage/.resultset.json') != '' }}
+        run: sudo chown -R "$(id -u):$(id -g)" my_api/coverage
+
+      - name: Prepare coverage artifact
+        if: ${{ always() && hashFiles('my_api/coverage/.resultset.json') != '' }}
+        run: cp my_api/coverage/.resultset.json my_api/coverage/resultset.json
+
+      - name: Upload coverage artifact
+        if: ${{ always() && hashFiles('my_api/coverage/resultset.json') != '' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: simplecov-resultset-my_api_request_specs
+          path: my_api/coverage/resultset.json
+
+      - name: Show my_api logs when failed
+        if: ${{ failure() }}
+        run: docker compose logs my_api
+
+      - name: Shutdown compose services
+        if: ${{ always() }}
+        run: docker compose down --volumes --remove-orphans
+
+  rubocop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: '4.0'
+          bundler-cache: false
+
+      - name: Install Bundler 2.x
+        run: gem install bundler -v "~> 2.0"
+
+      - name: Bundle install
+        run: bundle install
+
+      - name: Run RuboCop
+        run: bundle exec rubocop
+
+  yardoc:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: '4.0'
+          bundler-cache: false
+
+      - name: Install Bundler 2.x
+        run: gem install bundler -v "~> 2.0"
+
+      - name: Bundle install
+        run: bundle install
+
+      - name: Generate YARDoc
+        run: bundle exec yardoc -o ./yardoc
+
+      - name: Store YARDoc artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: yardoc
+          path: ./yardoc
+
+  upload_coverage:
+    name: upload-coverage
+    environment: coverage
+    # This job runs on pull_request as well.
+    # On fork-based pull requests, secrets are unavailable, so the Qlty upload
+    # step is skipped by its token guard. On same-repository pull requests,
+    # QLTY_COVERAGE_TOKEN is available and upload can run.
+    needs:
+      - build_gem
+      - verify_generator
+      - integration_api
+      - my_api_request_specs
+    runs-on: ubuntu-latest
+    env:
+      QLTY_COVERAGE_TOKEN: ${{ secrets.QLTY_COVERAGE_TOKEN }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
+        with:
+          ruby-version: '4.0'
+          bundler-cache: false
+
+      - name: Install Bundler 2.x
+        run: gem install bundler -v "~> 2.0"
+
+      - name: Bundle install
+        run: bundle install
+
+      - name: Download coverage artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: simplecov-resultset-*
+          path: tmp/simplecov-results
+
+      - name: Collate SimpleCov coverage
+        run: |
+          bundle exec ruby -e "
+            require 'simplecov'
+            require 'simplecov_json_formatter'
+
+            resultset_files = Dir['tmp/simplecov-results/**/resultset.json'].sort
+            abort('No SimpleCov resultset files found') if resultset_files.empty?
+
+            SimpleCov.collate(resultset_files) do
+              formatter SimpleCov::Formatter::JSONFormatter
+              coverage_dir('coverage')
+            end
+          "
+
+      - name: Upload merged coverage artifact
+        if: ${{ hashFiles('coverage/coverage.json') != '' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: merged-simplecov-coverage
+          path: coverage/coverage.json
+
+      - name: Upload coverage to Qlty
+        if: ${{ env.QLTY_COVERAGE_TOKEN != '' && hashFiles('coverage/coverage.json') != '' }}
+        uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0
+        with:
+          token: ${{ env.QLTY_COVERAGE_TOKEN }}
+          files: coverage/coverage.json
+
+      - name: Notify when Qlty token is missing
+        if: ${{ env.QLTY_COVERAGE_TOKEN == '' }}
+        run: |
+          echo "QLTY_COVERAGE_TOKEN is not set. Skipping coverage upload."

data/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,148 @@
+name: Dependabot Auto Merge
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+permissions: {}
+
+jobs:
+  enable-automerge-bundler:
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Validate bundler update safety
+        id: guard
+        if: ${{ steps.metadata.outputs.package-ecosystem == 'bundler' }}
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
+          DEPENDENCY_TYPE: ${{ steps.metadata.outputs.dependency-type }}
+          DEPENDENCY_NAME: ${{ steps.metadata.outputs.dependency-name }}
+          DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+        run: |
+          set -euo pipefail
+
+          safe=false
+
+          deps="$DEPENDENCY_NAMES"
+          if [[ -z "$deps" ]]; then
+            deps="$DEPENDENCY_NAME"
+          fi
+
+          rails_involved=false
+          while IFS= read -r dep; do
+            dep="$(echo "$dep" | xargs)"
+            [[ -z "$dep" ]] && continue
+            if [[ "$dep" == "rails" ]]; then
+              rails_involved=true
+            fi
+          done < <(echo "$deps" | tr ',' '\n')
+
+          if [[ "$HEAD_REF" == *"/rails_app/"* ]]; then
+            # Verification Rails apps: always auto-merge, except a major bump of the rails gem itself.
+            if [[ "$UPDATE_TYPE" == "version-update:semver-major" && "$rails_involved" == "true" ]]; then
+              echo "Skip auto-merge: major update of the rails gem in a rails_app verification app."
+              safe=false
+            else
+              safe=true
+            fi
+          elif [[ "$HEAD_REF" == *"/my_api/"* ]]; then
+            # Verification API app: always auto-merge regardless of update type.
+            safe=true
+          elif [[ ("$UPDATE_TYPE" == "version-update:semver-patch" || "$UPDATE_TYPE" == "version-update:semver-minor") && "$DEPENDENCY_TYPE" == "direct:development" ]]; then
+            # The gem itself (root Gemfile): only direct development patch/minor updates.
+            safe=true
+          else
+            echo "Skip auto-merge: gem update does not match auto-merge policy ($UPDATE_TYPE, $DEPENDENCY_TYPE)."
+          fi
+
+          echo "safe=$safe" >> "$GITHUB_OUTPUT"
+
+      - name: Enable auto-merge for safe bundler updates
+        if: ${{ steps.metadata.outputs.package-ecosystem == 'bundler' && steps.guard.outputs.safe == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: gh pr merge --repo "$GITHUB_REPOSITORY" --auto --merge "$PR_NUMBER"
+
+  enable-automerge-github-actions:
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Validate GitHub Actions update safety
+        id: guard
+        if: ${{ steps.metadata.outputs.package-ecosystem == 'github-actions' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
+          DEPENDENCY_NAME: ${{ steps.metadata.outputs.dependency-name }}
+          DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+        run: |
+          set -euo pipefail
+
+          safe=true
+
+          if [[ "$UPDATE_TYPE" != "version-update:semver-patch" && "$UPDATE_TYPE" != "version-update:semver-minor" ]]; then
+            echo "Skip auto-merge: update type is not patch/minor ($UPDATE_TYPE)."
+            safe=false
+          fi
+
+          deps="$DEPENDENCY_NAMES"
+          if [[ -z "$deps" ]]; then
+            deps="$DEPENDENCY_NAME"
+          fi
+
+          if [[ -z "$deps" ]]; then
+            echo "Skip auto-merge: dependency name is missing."
+            safe=false
+          else
+            while IFS= read -r dep; do
+              dep="$(echo "$dep" | xargs)"
+              [[ -z "$dep" ]] && continue
+
+              if [[ ! "$dep" =~ ^actions/ && ! "$dep" =~ ^github/ ]]; then
+                echo "Skip auto-merge: non-GitHub official action detected ($dep)."
+                safe=false
+              fi
+            done < <(echo "$deps" | tr ',' '\n')
+          fi
+
+          files_json="$(gh api -H "Accept: application/vnd.github+json" "/repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100")"
+          if echo "$files_json" | jq -r '.[] | select((.patch // "") | test("(?m)^[+-]\\s*(permissions|pull_request_target)\\s*:")) | .filename' | grep -q .; then
+            echo "Skip auto-merge: permissions or pull_request_target changes were detected."
+            safe=false
+          fi
+
+          echo "safe=$safe" >> "$GITHUB_OUTPUT"
+
+      - name: Enable auto-merge for safe GitHub Actions patch/minor updates
+        if: ${{ steps.metadata.outputs.package-ecosystem == 'github-actions' && steps.guard.outputs.safe == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: gh pr merge --repo "$GITHUB_REPOSITORY" --auto --merge "$PR_NUMBER"