veragem 0.1.0

data/lib/veragem/options.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "optparse"
+
+module Veragem
+  # The command line, read into a Project; git's config gives the author, the email and the GitHub
+  # user, as `bundle gem` reads them.
+  module Options
+    GIT_CONFIG = { author: "user.name", email: "user.email", github: "github.user" }.freeze
+
+    def self.parse(argv, config: ->(key) { git_config(key) })
+      values = GIT_CONFIG.transform_values { config.call(it) }
+      # an argument of invalid UTF-8 as bytes, as git's values are: OptionParser's matching raises on
+      # it, Project refuses it
+      names = parser.permute(argv.map { it.valid_encoding? ? it : it.b }, into: values)
+      raise Error, "one gem name, not #{names.size} (bundle veragem --help)" unless names.size == 1
+
+      # rubocop:disable-next Lint/NameTypo -- the project index lacks Class#new, and takes Project#nest for it
+      Project.new(names.fetch(0), { summary: "A Ruby gem.", license: "dual", **given(values) })
+    rescue OptionParser::ParseError => e
+      raise Error, "#{e.message} (bundle veragem --help)"
+    end
+
+    # The values set, the author and the GitHub user required.
+    def self.given(values)
+      %i[author github].each { raise Error, "no #{it}: --#{it}, or git config #{GIT_CONFIG[it]}" unless values[it] }
+      values.compact
+    end
+
+    def self.parser
+      OptionParser.new("Usage: bundle veragem NAME [options]") do |opts|
+        opts.program_name = "bundle veragem"
+        opts.version = VERSION
+        opts.on("--exe", "Add a command line, exe/NAME")
+        opts.on("--license=LICENSE", Project::LICENSES.keys, "mit, apache or dual (MIT OR Apache-2.0, the default)")
+        opts.on("--author=NAME", "The author (default: git config user.name)")
+        opts.on("--email=EMAIL", "The author's email (default: git config user.email)")
+        opts.on("--github=USER", "The GitHub user or organization (default: git config github.user)")
+        opts.on("--summary=TEXT", "The gem's summary (default: A Ruby gem.)")
+      end
+    end
+
+    # A git config value, nil when unset or git is missing: its bytes, which Project reads as UTF-8
+    # whatever the locale.
+    def self.git_config(key)
+      command = ["git", "config", "--get", key]
+      value = IO.popen(command, err: File::NULL, external_encoding: Encoding::BINARY, &:read).strip
+      value unless value.empty?
+    rescue SystemCallError
+      nil
+    end
+  end
+end

data/lib/veragem/project.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Veragem
+  # The gem to generate: the values given, checked, and what follows from them.
+  class Project
+    # GitHub's rule for a user or organization name.
+    GITHUB = /\A[a-z\d](?:[a-z\d]|-(?=[a-z\d])){0,38}\z/i
+    # Each choice's SPDX identifiers: the gemspec's licenses, the LICENSE-* files.
+    LICENSES = { "mit" => ["MIT"], "apache" => ["Apache-2.0"], "dual" => ["MIT", "Apache-2.0"] }.freeze
+
+    attr_reader :name, :author, :email, :github, :summary, :license, :exe
+
+    # +name+, and +values+: the author, email, github, summary and license (strings), exe (true or
+    # absent), as Options reads them.
+    def initialize(name, values)
+      @name = Name.check(name)
+      @author = text("author", values[:author])
+      @email = values[:email] && text("email", values[:email])
+      @github = valid("GitHub user", values[:github]) { GITHUB.match?(it) }
+      @summary = text("summary", values[:summary])
+      @license = valid("license (mit, apache or dual)", values[:license]) { LICENSES.key?(it) }
+      @exe = values[:exe] == true
+    end
+
+    # The file the gem requires: `my-gem`'s is my/gem.
+    def path = name.tr("-", "/")
+
+    def underscored = name.tr("-", "_")
+
+    # Its module, as `bundle gem` names it.
+    def constant = modules.join("::")
+
+    def modules = Name.modules(name)
+
+    def licenses = LICENSES.fetch(license)
+
+    def year = Time.now.year
+
+    # +value+ as a Ruby string literal, as written whatever the locale (String#inspect escapes
+    # what the locale cannot show): a quote, a backslash and an interpolation escaped.
+    def quote(value) = %("#{value.gsub(/["\\]|#(?=[{$@])/) { "\\#{it}" }}")
+
+    # +body+ inside the gem's modules, each nested and indented, +doc+ a comment on the innermost.
+    def nest(body, doc: nil)
+      *outer, inner = modules
+      code = "#{"# #{doc}\n" if doc}module #{inner}\n#{indent(body)}end\n"
+      outer.reverse.reduce(code) { |nested, mod| "module #{mod}\n#{indent(nested)}end\n" }
+    end
+
+    private
+
+    def indent(code) = code.gsub(/^(?=.)/, "  ")
+
+    def valid(field, value)
+      raise Error, "invalid #{field} #{value.inspect}" unless yield value
+
+      value
+    end
+
+    # A value a file quotes: one line of valid UTF-8, its surrounding spaces stripped (Unicode's too),
+    # short enough for the gemspec's line (RuboCop's 120 columns), which RubyGems does not refuse as
+    # unfinished.
+    def text(field, value)
+      value = value.dup.force_encoding(Encoding::UTF_8)
+      one_line = value.valid_encoding? && !value.match?(/[[:cntrl:]\u2028\u2029]/)
+      line = one_line ? value.gsub(/\A[[:space:]]+|[[:space:]]+\z/, "") : ""
+      raise Error, "invalid #{field} #{value.inspect}: one line of text" if line.empty?
+      raise Error, "invalid #{field}: too long, its Ruby string at most 100 characters" if quote(line).length > 100
+      if line.match?(/\A(TODO|FIXME)/)
+        raise Error,
+              "invalid #{field} #{line.inspect}: RubyGems refuses one starting TODO or FIXME"
+      end
+
+      line
+    end
+  end
+end

data/lib/veragem/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Veragem
+  VERSION = "0.1.0"
+end

data/lib/veragem.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "bundler"
+require_relative "veragem/version"
+require_relative "veragem/name"
+require_relative "veragem/project"
+require_relative "veragem/options"
+require_relative "veragem/generator"
+
+# `bundle veragem NAME`: a new gem, its toolchain wired up.
+module Veragem
+  # A refusal: Bundler prints its message alone, and exits with its status.
+  class Error < Bundler::PluginError; end
+
+  # Generates the gem +argv+ names into +dir+; returns its directory.
+  def self.run(argv, dir: Dir.pwd)
+    project = Options.parse(argv)
+    target = File.join(dir, project.name)
+    Generator.generate(project, target)
+    puts "Created #{project.name}. Next: cd #{project.name} && bin/setup (CONTRIBUTING.md's first steps)"
+    target
+  end
+end

data/plugins.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+# Bundler loads this file to find the plugin's command: `bundle veragem`.
+require "veragem" # Bundler puts the plugin's lib/ on the load path first
+
+module Veragem
+  # The command, Bundler's plugin API.
+  class Command < Bundler::Plugin::API
+    command "veragem"
+
+    def exec(_command, args)
+      Veragem.run(args)
+    end
+  end
+end

data/sig/bundler.rbs

@@ -0,0 +1,10 @@
+# The part of Bundler the plugin uses: Bundler ships no signatures, nor does gem_rbs_collection.
+module Bundler
+  def self.unbundled_env: () -> Hash[String, String]
+
+  class BundlerError < StandardError
+  end
+
+  class PluginError < BundlerError
+  end
+end

data/sig/veragem.rbs

@@ -0,0 +1,79 @@
+module Veragem
+  VERSION: String
+
+  class Error < Bundler::PluginError
+  end
+
+  def self.run: (Array[String] argv, ?dir: String) -> String
+
+  module Name
+    PATTERN: Regexp
+    PROBE: String
+
+    def self.modules: (String name) -> Array[String]
+    def self.check: (String name) -> String
+    def self.check_modules: (String name) -> void
+    def self.check_shadowing: (String name, String shadowed, String found) -> void
+    def self.check_defined: (String name, Array[[String, String?]] defined, String? innermost) -> void
+    def self.library_of: (String name) -> String
+    def self.nestings_of: (String name) -> Array[String]
+    def self.probe: (String library, String path, Array[String] nestings) -> Array[String]
+  end
+
+  class Project
+    GITHUB: Regexp
+    LICENSES: Hash[String, Array[String]]
+
+    attr_reader name: String
+    attr_reader author: String
+    attr_reader email: String?
+    attr_reader github: String
+    attr_reader summary: String
+    attr_reader license: String
+    attr_reader exe: bool
+
+    def initialize: (String name, Hash[Symbol, untyped] values) -> void
+    def path: () -> String
+    def underscored: () -> String
+    def constant: () -> String
+    def modules: () -> Array[String]
+    def licenses: () -> Array[String]
+    def year: () -> Integer
+    def quote: (String value) -> String
+    def nest: (String body, ?doc: String?) -> String
+
+    private
+
+    def indent: (String code) -> String
+    def valid: [T < Object] (String field, T value) { (T) -> bool } -> T
+    def text: (String field, String value) -> String
+  end
+
+  module Options
+    GIT_CONFIG: Hash[Symbol, String]
+
+    def self.parse: (Array[String] argv, ?config: ^(String) -> String?) -> Project
+    def self.given: (Hash[Symbol, untyped] values) -> Hash[Symbol, untyped]
+    def self.parser: () -> OptionParser
+    def self.git_config: (String key) -> String?
+  end
+
+  module Generator
+    TEMPLATE: String
+    EXE: Array[String]
+    GIT_LOCAL: Hash[String, nil]
+    LICENSE_FILES: Hash[String, String]
+
+    def self.files: (Project project) -> Hash[String, String]
+    def self.skipped: (Project project) -> Array[String]
+    def self.tools: () -> Array[String]
+    def self.check: (Project project, Array[String] paths) -> void
+    def self.check_command: (Project project) -> void
+    def self.path_of: (String file, Project project) -> String
+    def self.generate: (Project project, String target) -> void
+    def self.removed_unless_done: (String target) { () -> void } -> void
+    def self.write: (String source, String destination, Project project) -> void
+    def self.render: (String source, Project project) -> String
+    def self.git: (String dir, *String args) -> void
+  end
+end

data/template/%name%.gemspec.erb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative "lib/<%= path %>/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "<%= name %>"
+  spec.version = <%= constant %>::VERSION
+  spec.authors = [<%= quote(author) %>]
+<%- if email -%>
+  spec.email = [<%= quote(email) %>]
+<%- end -%>
+
+  spec.summary = <%= quote(summary) %>
+  spec.homepage = "https://github.com/<%= github %>/<%= name %>"
+  spec.licenses = <%= licenses.inspect %>
+  spec.required_ruby_version = ">= 4.0"
+
+  spec.metadata["source_code_uri"] = spec.homepage
+  spec.metadata["changelog_uri"] = "#{spec.homepage}/blob/main/CHANGELOG.md"
+  spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
+  spec.metadata["rubygems_mfa_required"] = "true"
+
+  # What the gem ships: its code, its signatures and its documents -- not the tests or the tooling.
+  spec.files = Dir.glob(%w[lib/**/*.rb sig/**/*.rbs exe/* README.md CHANGELOG.md LICENSE-*], base: __dir__)
+<%- if exe -%>
+  spec.bindir = "exe"
+  spec.executables = ["<%= name %>"]
+<%- end -%>
+  spec.require_paths = ["lib"]
+end

data/template/.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+# shfmt's style (it reads this when given no formatting flag): the shell scripts, and the git
+# hooks, which have no extension
+[*.sh]
+indent_style = space
+indent_size = 2
+switch_case_indent = true
+space_redirects = true
+
+[.githooks/*]
+indent_style = space
+indent_size = 2
+switch_case_indent = true
+space_redirects = true

data/template/.githooks/commit-msg

@@ -0,0 +1,12 @@
+#!/bin/sh
+# The message, as CI's Conventional Commits check will read it -- a merge
+# commit's excepted, as CI excepts it (cog.toml's ignore_merge_commits).
+set -eu
+if git rev-parse -q --verify MERGE_HEAD > /dev/null; then exit 0; fi
+# `cog verify` reads the author from git's config -- GIT_AUTHOR_NAME and the like are not
+# config -- and panics without it
+if ! git config user.name > /dev/null || ! git config user.email > /dev/null; then
+  echo "commit-msg: cog verify needs git's user.name and user.email (git config)" >&2
+  exit 1
+fi
+cog verify --file "$1"

data/template/.githooks/pre-commit

@@ -0,0 +1,6 @@
+#!/bin/sh
+# What fails fastest, so a commit stays quick: RuboCop, the shell, the workflows, dprint; the
+# types, the tests and the rest are `bundle exec rake checks` and CI. Checks the working tree, not
+# just what is staged.
+set -eu
+bundle exec rake rubocop shell workflows dprint

data/template/.githooks/pre-push

@@ -0,0 +1,17 @@
+#!/bin/sh
+# The history of every pushed ref, as CI checks main's: `git revert` and
+# `git cherry-pick` commit without running commit-msg, and their default
+# messages (`Revert "..."`) are not Conventional Commits.
+set -eu
+while read -r line; do
+  # <local ref> <local oid> <remote ref> <remote oid>, read from the right:
+  # the local ref is as typed, and may hold spaces (`main@{1 day ago}`)
+  line="${line% *}"
+  line="${line% *}"
+  local_oid="${line##* }"
+  case "$local_oid" in
+    # `..<commit>`: all its history, as `cog check` reads HEAD's
+    *[!0]*) cog check "..$(git rev-parse "$local_oid^{commit}")" ;;
+    *) ;; # a deletion: nothing is pushed
+  esac
+done

data/template/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug Report
+about: Report incorrect or unexpected behaviour
+title: "bug: "
+labels: "bug"
+assignees: ""
+---
+
+## System Context
+
+- **OS / kernel version:**
+- **Ruby version (`ruby -v`):**
+- **Gem version or commit:**
+
+## Expected Behavior
+
+[Describe what should have happened.]
+
+## Actual Behavior
+
+[Describe the failure. Include raw terminal output, tracebacks, or logs.]
+
+## Reproduction
+
+1. [Step 1]
+2. [Step 2]
+3. [Command executed]

data/template/.github/ISSUE_TEMPLATE/config.yml.erb

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a Security Vulnerability
+    url: https://github.com/<%= github %>/<%= name %>/security/advisories/new
+    about: Privately report a vulnerability. Do NOT use standard issues.

data/template/.github/ISSUE_TEMPLATE/documentation.md

@@ -0,0 +1,19 @@
+---
+name: Documentation / Meta
+about: Fix documentation or internal repository rules
+title: "docs: "
+labels: "documentation"
+assignees: ""
+---
+
+## Target
+
+[Which file is being modified?]
+
+## Issue
+
+[What is wrong or missing?]
+
+## Proposed Change
+
+[Briefly describe the correction.]

data/template/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,15 @@
+---
+name: Architecture Proposal / Feature
+about: Propose a structural change or new capability
+title: "feat: "
+labels: "enhancement"
+assignees: ""
+---
+
+## Technical Proposal
+
+[Describe the proposed implementation or architectural change.]
+
+## Justification
+
+[Why is this necessary? What does it make possible that is not possible today?]

data/template/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,14 @@
+## Problem
+
+[Describe the exact bug, limitation, or requirement this PR addresses.]
+
+## Proposed Solution
+
+[Describe the change and anything about the approach that is not obvious from the diff.]
+
+## Verification
+
+- [ ] Code passes local CI (`bundle exec rake checks`).
+- [ ] Core logic is extracted into pure, unit-testable functions.
+- [ ] Any new `# rubocop:disable` or `# steep:ignore` names its cop or diagnostic and says why it is wrong here (RuboCop's after `--`, Steep's on the line above: AGENTS.md).
+- [ ] Commits follow [Conventional Commits](https://www.conventionalcommits.org/).

data/template/.github/dependabot.yml

@@ -0,0 +1,85 @@
+# The gems (Gemfile.lock), weekly; GitHub Actions, pinned to commits, each release in a comment,
+# and Dependabot moves both (docs.github.com, "Dependabot supported ecosystems"), weekly; the
+# flake's inputs, monthly.
+version: 2
+updates:
+  - package-ecosystem: "bundler"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "07:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    # `chore(deps): ...` -- no changelog entry: the lock is not in the gem, whose users resolve its
+    # gemspec's requirements themselves
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels: # each created once (Issues > Labels): one the repository lacks is ignored
+      - "dependencies"
+      - "ruby"
+    groups:
+      # minor and patch updates in one pull request (dependabot-automerge.yml merges it once the
+      # checks pass); a major one alone, for review
+      gems:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    # a release a week old at least, time for a compromised one to be found and yanked first
+    # (zizmor's minimum; Dependabot's default is 3 days). A security update is not held back
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "07:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    # `ci(deps): ...` -- nothing a user of the gem meets, so no changelog entry
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "actions"
+    groups:
+      actions-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    cooldown:
+      default-days: 7
+
+  # the flake's inputs, monthly, in one pull request (Dependabot's `nix` ecosystem: each input to
+  # its branch's newest commit). A person merges it: dependabot-automerge.yml takes patch and minor
+  # bumps alone, and a commit's move is neither. An input in a private repository is not moved
+  # (docs.github.com, "Supported ecosystems and repositories"): `nix flake update` by hand for it
+  - package-ecosystem: "nix"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 1
+    # `chore(deps): ...` -- the flake is the development shell, the checks and the Nix package,
+    # nothing RubyGems ships: a command's image takes the new inputs at its next release
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
+      - "nix"
+    groups:
+      flake-inputs:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7

data/template/.github/image-registries.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# The repositories a release's image goes to, one a line, each logged in before anything is
+# pushed: GHCR's always (the job's token), Docker Hub's when both vars.DOCKERHUB_USERNAME and
+# secrets.DOCKERHUB_TOKEN are set -- the name vars.DOCKERHUB_REPOSITORY, else <username>/<the
+# GitHub repository's name>. image.yml's; it passes GH_TOKEN and DOCKERHUB_USERNAME,
+# DOCKERHUB_TOKEN and DOCKERHUB_REPOSITORY (empty when unset).
+set -euo pipefail
+
+docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin <<< "${GH_TOKEN:?}" >&2
+echo "ghcr.io/${GITHUB_REPOSITORY,,}"
+
+username=${DOCKERHUB_USERNAME:-}
+token=${DOCKERHUB_TOKEN:-}
+if [[ -z $username && -z $token ]]; then
+  exit 0
+elif [[ -z $username || -z $token ]]; then
+  echo "error: Docker Hub needs both vars.DOCKERHUB_USERNAME and secrets.DOCKERHUB_TOKEN" >&2
+  exit 1
+fi
+repository=${DOCKERHUB_REPOSITORY:-$username/${GITHUB_REPOSITORY#*/}}
+repository=${repository,,}
+# a reference Docker takes (its grammar's path components), its name as Docker Hub's: lowercase
+# letters and digits, `-` and `_` between them, 2 to 255 characters (Docker Hub's docs)
+name=${repository#*/}
+if [[ ! $repository =~ ^[a-z0-9]+((\.|_|__|-+)[a-z0-9]+)*/[a-z0-9]+((_|__|-+)[a-z0-9]+)*$ ]] ||
+  ((${#name} < 2 || ${#name} > 255)); then
+  echo "error: '$repository' is no Docker Hub repository: set vars.DOCKERHUB_REPOSITORY" >&2
+  exit 1
+fi
+docker login docker.io --username "$username" --password-stdin <<< "$token" >&2
+echo "docker.io/$repository"

data/template/.github/release-notes.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# A release's notes: CHANGELOG.md's first section, up to the second `## ` heading, refused unless
+# it is the version's own (`rake bump` writes it on top). The release workflow's.
+set -euo pipefail
+
+changelog=${1:?usage: release-notes.sh CHANGELOG VERSION}
+version=${2:?usage: release-notes.sh CHANGELOG VERSION}
+notes=$(awk '/^## /{n++} n==1' "$changelog")
+if [[ $notes != "## [$version]("* ]]; then
+  echo "$changelog: the first section is not $version's" >&2
+  exit 1
+fi
+printf '%s\n' "$notes"

data/template/.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,70 @@
+name: Dependabot Auto-Merge
+
+# Required repository settings (do these once):
+# 1. Settings → General → Allow auto-merge          ← enable
+# 2. Settings → Branches → Branch protection rule on main:
+#      - Require a pull request before merging, with no required approvals
+#        (one would hold every bump for a person)
+#      - Require status checks to pass before merging (select the real CI
+#        jobs: every job the workflows run on every pull request -- not one
+#        whose `pull_request:` has `paths:`, which reports only when those
+#        paths change, so would block every other merge)
+#
+# The `permissions:` below are all this workflow's token needs; the
+# repository's default token permissions can stay read-only, and nothing
+# here creates or approves a pull request. Leave the rule's bypass to
+# admins allowed: `rake release` pushes its commit and tag to main.
+#
+# A merge this token makes starts no workflow run (GitHub's rule for
+# GITHUB_TOKEN's events): main runs nothing for it, its pull request's
+# required checks are what gated it.
+#
+# Without step 2, this workflow merges bumps that no CI job gated:
+# auto-merge waits for *required* checks alone.
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    # user.login, not github.actor: the account that opened the pull request,
+    # not whoever caused the event (a person pushing to Dependabot's branch
+    # too).
+    # Ref: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
+    # github.actor: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
+    #
+    # To keep forks from auto-merging their own bumps, pin the repository:
+    #     && github.repository == 'your-org/your-repo'
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for patch and minor updates
+        # update-type is the highest version-update:semver-{major,minor,patch}
+        # among the updated dependencies whose level is known (Dependabot's
+        # metadata, else their versions); empty when none is, which this
+        # condition refuses. A security update carries the same labels, no
+        # "security:" prefix. To gate on security status, enable alert-lookup
+        # with a PAT or an App's token (a Dependabot secret: a run Dependabot
+        # starts reads no other) and check steps.metadata.outputs.alert-state
+        # (the first dependency's alert).
+        if: >-
+          contains(
+            fromJSON('["version-update:semver-patch", "version-update:semver-minor"]'),
+            steps.metadata.outputs.update-type
+          )
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}