@homeflare/config 0.11.0 → 0.12.0

package/dist/repo-shape.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-shape.d.ts","sourceRoot":"","sources":["../src/repo-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,MAAM,EACN,QAAQ,EACR,UAAU,EACV,MAAM,GACP,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"repo-shape.d.ts","sourceRoot":"","sources":["../src/repo-shape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,KAAK,aAAa,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC7F,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,cAAc,EACd,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,MAAM,EACX,MAAM,EACN,QAAQ,EACR,UAAU,EACV,MAAM,GACP,MAAM,uBAAuB,CAAC"}

package/dist/repo-shape.js

@@ -1,106 +1,4 @@
 // @bun
-// src/repo-shape/dependabot.ts
-var HOMEFLARE_GROUP = "homeflare";
-var HOMEFLARE_PATTERN = "@homeflare/*";
-var THIRD_PARTY_COOLDOWN_DAYS = 7;
-function renderDependabot(shape) {
-  const bunDirs = shape.publishes ? ["/", "/packages/*"] : ["/"];
-  return `# Dependabot for ${shape.repository}.
-#
-# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
-#    Refresh with \`bun run repo-shape:refresh\`.
-#
-# \u26D4 THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
-#   platform feature, not an Action \u2014 a config placed among the workflows is silently
-#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
-#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
-#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
-#
-# \u2605 WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
-#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
-#   that is either safe to take together or needs deciding together.
-#
-# \u2605 THE BILLING LOCK DOES NOT STOP THIS FILE. Dependabot runs as a GitHub-hosted "dynamic"
-#   workflow that GitHub's docs say "does not count towards your included GitHub Actions
-#   minutes"; measured 2026-09-22, a private estate repository's Dependabot job got a hosted
-#   runner 86 minutes after that account's ordinary hosted jobs were refused for billing.
-#   It cannot use the mini anyway: a self-hosted Dependabot runner must be Linux x64 with
-#   Docker, and the mini's runners are arm64 containers with no Docker socket.
-version: 2
-
-updates:
-  # \u2500\u2500 The toolchain (bun.lock) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  # \u26A0\uFE0F BLOCKED UPSTREAM, 2026-09-22: bun 1.4 writes bun.lock \`lockfileVersion\` 2 and
-  #   Dependabot's updater bundles bun 1.3.14, which reads up to 1, so this block fails in
-  #   every estate repository with "Unsupported bun.lock 'lockfileVersion' 2". The fix is
-  #   dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.
-  # \u26D4 ONE BUN BLOCK, SO ONE SCHEDULE. Dependabot refuses two blocks for one ecosystem and
-  #   target branch whose directories overlap, so the \`homeflare\` group cannot be daily
-  #   while the rest stays weekly. The block is daily; \`cooldown\` slows the rest.
-  - package-ecosystem: bun
-    directories:
-${bunDirs.map((dir) => `      - ${dir}`).join(`
-`)}
-    schedule:
-      # \u26A0\uFE0F Dependabot's \`daily\` is Monday to Friday; a weekend kit release lands on Monday.
-      interval: daily
-      time: '09:00'
-      timezone: America/New_York
-    # \u26D4 THE EXCLUDE IS NOT OPTIONAL. Dependabot applies a 3-day cooldown to every version
-    #   update even when this key is absent, so without it a kit release would wait three
-    #   days before its bump opened \u2014 and "daily" would quietly mean "three days late".
-    cooldown:
-      default-days: ${THIRD_PARTY_COOLDOWN_DAYS}
-      exclude: ['${HOMEFLARE_PATTERN}']
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'chore'
-      include: scope
-    labels: [dependencies]
-    groups:
-      # \u2605 FIRST, AND EVERY UPDATE TYPE. A kit release is one set of packages built to work
-      #   together, so they move as one pull request; \`bun run check\` is what reads it, and
-      #   .github/workflows/dependabot-automerge.yml merges it when that is green.
-      #   \u26A0\uFE0F A release that changes what @homeflare/config renders fails the drift test here
-      #   by design; \`bun run repo-shape:refresh\` on the branch is the one-command fix.
-      ${HOMEFLARE_GROUP}:
-        patterns: ['${HOMEFLARE_PATTERN}']
-
-      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
-      # noise unless they fail CI, which is what CI is for.
-      lint-and-format:
-        patterns: ['oxfmt', 'oxlint']
-        update-types: [minor, patch]
-
-      # \u26A0\uFE0F MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
-      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
-      #   did both). These want reading, not merging on green.
-      build-tooling:
-        patterns: ['typescript', '@changesets/*', '@types/bun']
-        update-types: [minor, patch]
-
-  # \u2500\u2500 The workflows themselves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  # \u2605 Actions go stale invisibly: nothing fails, they just keep running old code. The
-  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
-  #   (current: v2, with every input renamed) \u2014 measured 2026-09-15.
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: '09:00'
-      timezone: America/New_York
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'ci'
-    labels: [dependencies, github-actions]
-    groups:
-      actions:
-        patterns: ['*']
-        update-types: [minor, patch]
-`;
-}
-
 // src/repo-shape/guards.ts
 var SENTENCE = 12;
 function requireNonEmpty(field, value) {
@@ -191,8 +89,14 @@ function scalar(value) {
 function renderMapping(entries, depth) {
   return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);
 }
+function trimTrailingNewlines(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 10)
+    end--;
+  return value.slice(0, end);
+}
 function renderRun(command, depth) {
-  const lines = command.replace(/\n+$/, "").split(`
+  const lines = trimTrailingNewlines(command).split(`
 `);
   if (lines.length === 1)
     return [`${indent(depth)}run: ${scalar(lines[0] ?? "")}`];
@@ -221,92 +125,6 @@ function renderSteps(steps, depth) {
 `);
 }
 
-// src/repo-shape/automerge.ts
-var GROUP_BRANCH_PREFIX = `dependabot/bun/${HOMEFLARE_GROUP}-`;
-var GROUP_BRANCH = `^${GROUP_BRANCH_PREFIX}[0-9a-f]{10}$`;
-var HEADER = `# Arms auto-merge on Dependabot's @homeflare/* group, and on nothing else.
-#
-# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
-#    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
-#
-# \u2605 HOW A KIT RELEASE ARRIVES: the \`${HOMEFLARE_GROUP}\` group in .github/dependabot.yml opens one
-#   pull request; this arms GitHub's auto-merge on it; the ruleset's required checks decide.
-#   Nothing here merges anything itself, and merging deploys nothing.
-# \u26D4 NO THIRD-PARTY ACTION. GitHub's own example uses dependabot/fetch-metadata, which its
-#   docs mark "not certified by GitHub"; the group is recognised by its branch name instead.
-# \u26D4 NO REQUIRED CHECK ON THE BASE BRANCH, NO ARMING: there \`gh pr merge --auto\` would merge
-#   at once, unchecked. The job fails instead, so the pull request waits for a person.
-# \u26A0\uFE0F A RENDERER CHANGE STILL NEEDS A PERSON. When a kit release changes what @homeflare/config
-#   renders, the bump fails \`check\` (the drift test) and never goes green. Run
-#   \`bun run repo-shape:refresh\` on Dependabot's branch and push. \u26D4 This workflow does not do
-#   it for you: a push made with GITHUB_TOKEN starts no workflow run, so a refreshed commit
-#   would never get the required checks and the pull request would wait forever.
-`;
-var TRIGGER = `name: dependabot auto-merge
-
-on:
-  pull_request:
-
-# \u26D4 NOTHING AT THE TOP; the one job asks for exactly what \`gh pr merge --auto\` needs.
-permissions: {}
-
-concurrency:
-  group: automerge-\${{ github.ref }}
-  cancel-in-progress: true
-`;
-var JOB_NOTE = `  # \u26D4 BOTH LOGINS, NOT EITHER. \`user.login\` is who opened the pull request; \`github.actor\` is
-  #   who started this run. A person pushing to Dependabot's branch changes the actor, so
-  #   their commit never arms anything; only Dependabot's own rebases do.`;
-var PERMISSIONS_NOTE = `    # \u2605 WHAT GitHub'S OWN EXAMPLE GRANTS FOR THIS STEP, AND NO MORE. A run Dependabot starts gets
-    #   a read-only GITHUB_TOKEN unless the workflow raises it ("Troubleshooting Dependabot on
-    #   GitHub Actions" \u2192 "Changing GITHUB_TOKEN permissions").`;
-var ARM = `set -euo pipefail
-if [[ ! "$HEAD_REF" =~ ${GROUP_BRANCH} ]]; then
-  echo "::notice::$HEAD_REF is not the ${HOMEFLARE_GROUP} group's branch; auto-merge not armed"
-  exit 0
-fi
-# \u26D4 gh merges a CLEAN or UNSTABLE pull request at once rather than arming it. Only a branch
-#   rule that requires a status check keeps it BLOCKED until the checks have passed.
-required=$(gh api "repos/$GITHUB_REPOSITORY/rules/branches/$BASE_REF" \\
-  --jq '[.[] | select(.type == "required_status_checks")] | length')
-if [ "$required" = 0 ]; then
-  echo "::error::$BASE_REF requires no status check, so gh would merge at once; auto-merge not armed"
-  exit 1
-fi
-# \u2605 --squash: the house repositories allow squash merges only (declareRepoPolicy).
-gh pr merge --auto --squash "$PR_URL"`;
-function renderAutomerge(shape) {
-  const headRef = "${{ github.head_ref }}";
-  const baseRef = "${{ github.base_ref }}";
-  const prUrl = "${{ github.event.pull_request.html_url }}";
-  const token = "${{ secrets.GITHUB_TOKEN }}";
-  const condition = [
-    "github.event.pull_request.user.login == 'dependabot[bot]'",
-    "github.actor == 'dependabot[bot]'",
-    `startsWith(github.head_ref, '${GROUP_BRANCH_PREFIX}')`
-  ].join(" && ");
-  return `${HEADER}
-${TRIGGER}
-jobs:
-${JOB_NOTE}
-  arm:
-    name: arm auto-merge
-    if: ${condition}
-    runs-on: ${runsOn(shape.runner)}
-${PERMISSIONS_NOTE}
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-${renderSteps([
-    {
-      env: { BASE_REF: baseRef, GH_TOKEN: token, HEAD_REF: headRef, PR_URL: prUrl },
-      name: "Arm auto-merge on the homeflare group",
-      run: ARM
-    }
-  ], 3)}
-`;
-}
 // src/repo-shape/ci.ts
 var BUN_VERSION = "1.4.0";
 var ACTIONLINT_VERSION = "1.7.12";
@@ -327,7 +145,7 @@ function runnerNote(shape) {
   ].join(`
 `);
 }
-var HEADER2 = `# Pull requests: is this code correct?
+var HEADER = `# Pull requests: is this code correct?
 #
 # \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
 #    Its input is this repository's \`repo-shape.ts\`. Change that, then:
@@ -340,7 +158,7 @@ var HEADER2 = `# Pull requests: is this code correct?
 #   share a prologue are steps inside \`check\`, so the install is paid once.
 # \u26D4 EVERY ACTION IS FIRST-PARTY OR THE VENDOR'S OWN, PINNED TO A MAJOR TAG.
 `;
-var TRIGGER2 = `name: ci
+var TRIGGER = `name: ci
 
 on:
   # \u26D4 NO \`push: branches: [main]\`. Every commit reaches main through a pull request whose
@@ -471,7 +289,7 @@ function renderCi(shape) {
   const on = runsOn(shape.runner);
   const extras = shape.extraJobs ?? [];
   const needs = ["check", "workflows", ...extras.map((job) => job.id)];
-  return `${HEADER2}${runnerNote(shape)}${TRIGGER2}
+  return `${HEADER}${runnerNote(shape)}${TRIGGER}
 jobs:
 ${CHECK_NOTE}
   check:
@@ -538,9 +356,101 @@ self-hosted-runner:
     - homeflare-mini
 `;
 }
+// src/repo-shape/dependabot.ts
+var HOMEFLARE_PATTERN = "@homeflare/*";
+var THIRD_PARTY_COOLDOWN_DAYS = 7;
+function renderDependabot(shape) {
+  const bunDirs = shape.publishes ? ["/", "/packages/*"] : ["/"];
+  return `# Dependabot for ${shape.repository}.
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Refresh with \`bun run repo-shape:refresh\`.
+#
+# \u26D4 THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
+#   platform feature, not an Action \u2014 a config placed among the workflows is silently
+#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
+#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
+#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
+#
+# \u2605 WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
+#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
+#   that is either safe to take together or needs deciding together.
+#
+# \u2605 THE BILLING LOCK DOES NOT STOP THIS FILE. Dependabot runs as a GitHub-hosted "dynamic"
+#   workflow that GitHub's docs say "does not count towards your included GitHub Actions
+#   minutes"; measured 2026-09-22, a private estate repository's Dependabot job got a hosted
+#   runner 86 minutes after that account's ordinary hosted jobs were refused for billing.
+#   It cannot use the mini anyway: a self-hosted Dependabot runner must be Linux x64 with
+#   Docker, and the mini's runners are arm64 containers with no Docker socket.
+version: 2
+
+updates:
+  # \u2500\u2500 The toolchain (bun.lock) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u26A0\uFE0F STILL BLOCKED UPSTREAM, 2026-09-22 \u2014 unrelated to the ignore below. bun 1.4 writes
+  #   bun.lock \`lockfileVersion\` 2 and Dependabot's updater bundles bun 1.3.14, which reads
+  #   up to 1, so this whole block fails in every estate repository with "Unsupported
+  #   bun.lock 'lockfileVersion' 2" before it reads a single manifest. The fix is
+  #   dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.
+  - package-ecosystem: bun
+    directories:
+${bunDirs.map((dir) => `      - ${dir}`).join(`
+`)}
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: America/New_York
+    cooldown:
+      default-days: ${THIRD_PARTY_COOLDOWN_DAYS}
+    # \u26D4 NEVER PROPOSED HERE. \`homeflare-bumper\` opens the one pull request that bumps
+    #   \`@homeflare/*\` (kit auto-bumper design, Tim 2026-09-23) \u2014 a Dependabot
+    #   update for the same package would race it and, on the weeks they disagree, leave
+    #   two open pull requests fighting over the same \`package.json\` line.
+    ignore:
+      - dependency-name: '${HOMEFLARE_PATTERN}'
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'chore'
+      include: scope
+    labels: [dependencies]
+    groups:
+      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
+      # noise unless they fail CI, which is what CI is for.
+      lint-and-format:
+        patterns: ['oxfmt', 'oxlint']
+        update-types: [minor, patch]
+
+      # \u26A0\uFE0F MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
+      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
+      #   did both). These want reading, not merging on green.
+      build-tooling:
+        patterns: ['typescript', '@changesets/*', '@types/bun']
+        update-types: [minor, patch]
+
+  # \u2500\u2500 The workflows themselves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u2605 Actions go stale invisibly: nothing fails, they just keep running old code. The
+  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
+  #   (current: v2, with every input renamed) \u2014 measured 2026-09-15.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: America/New_York
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'ci'
+    labels: [dependencies, github-actions]
+    groups:
+      actions:
+        patterns: ['*']
+        update-types: [minor, patch]
+`;
+}
 // src/repo-shape/security.ts
 var CRON = "41 6 * * 1";
-var HEADER3 = `# Secret scanning, on its own schedule and its own check.
+var HEADER2 = `# Secret scanning, on its own schedule and its own check.
 #
 # \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
 #    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
@@ -550,7 +460,7 @@ var HEADER3 = `# Secret scanning, on its own schedule and its own check.
 #   tomorrow can find a secret committed today), and it needs full history, which the CI
 #   jobs deliberately do not fetch.
 `;
-var TRIGGER3 = `name: security
+var TRIGGER2 = `name: security
 
 on:
   # \u26D4 NO \`push: branches: [main]\`, for the reason ci.yml gives: main only moves by
@@ -601,7 +511,7 @@ function renderSecurity(shape) {
     # \u26D4 THE SCHEDULED RUN GOES TO THE MINI TOO: if the runner daemon is down this queues
     #   rather than failing, so a missed weekly scan is silent. homeflare-mini's
     #   \`ci-runner\` vmalert group is what notices that, not this workflow.` : "";
-  return `${HEADER3}${TRIGGER3}
+  return `${HEADER2}${TRIGGER2}
 jobs:
   secrets:
     name: secret scan${scheduled}
@@ -621,7 +531,6 @@ function renderRepoShape(shape) {
     ".changeset/config.json": renderChangesetConfig(shape),
     ".github/dependabot.yml": renderDependabot(shape),
     ".github/workflows/ci.yml": renderCi(shape),
-    ".github/workflows/dependabot-automerge.yml": renderAutomerge(shape),
     ".github/workflows/security.yml": renderSecurity(shape)
   };
   const actionlint = renderActionlintConfig(shape);
@@ -637,7 +546,6 @@ var RENDERED_PATHS = [
   ".github/actionlint.yaml",
   ".github/dependabot.yml",
   ".github/workflows/ci.yml",
-  ".github/workflows/dependabot-automerge.yml",
   ".github/workflows/security.yml"
 ];
 
@@ -751,9 +659,6 @@ async function repoShapeCli(projectDir, shape, argv) {
 export {
   ACTIONLINT_VERSION,
   BUN_VERSION,
-  GROUP_BRANCH,
-  GROUP_BRANCH_PREFIX,
-  HOMEFLARE_GROUP,
   HOMEFLARE_PATTERN,
   REFRESH_COMMAND,
   RENDERED_PATHS,
@@ -765,7 +670,6 @@ export {
   isExcepted,
   refreshRepoShape,
   renderActionlintConfig,
-  renderAutomerge,
   renderChangesetConfig,
   renderCi,
   renderDependabot,
@@ -775,5 +679,5 @@ export {
   runsOn
 };
 
-//# debugId=2943BDDA9944E35364756E2164756E21
+//# debugId=27828123E35E339964756E2164756E21
 //# sourceMappingURL=repo-shape.js.map