@homeflare/config 0.11.0 → 0.12.0

package/src/repo-shape/automerge.ts

@@ -1,144 +0,0 @@
-/**
- * `.github/workflows/dependabot-automerge.yml`, rendered.
- *
- * ★ THE OTHER HALF OF THE `homeflare` GROUP. Dependabot opens the bump; this arms GitHub's
- *   own auto-merge on it; the branch ruleset's required checks (`ci`, `secret scan`)
- *   decide whether it ever merges. Nothing here merges anything itself, and a merge
- *   deploys nothing — every stack in the estate is deployed by hand.
- *
- * ⛔ `gh pr merge --auto` IS NOT ALWAYS "ARM". When the pull request is already CLEAN,
- *   UNSTABLE or HAS_HOOKS it merges AT ONCE instead (cli/cli `pkg/cmd/pr/merge/merge.go`,
- *   `isImmediatelyMergeable`, read at v2.101.0 — the version the mini's job image ships).
- *   UNSTABLE is "mergeable, with a non-passing status", which is every pull request on a
- *   branch whose rules require no check: before `check` has run, and even after it failed.
- *   So the step reads the base branch's active rules first and refuses — a red check, never
- *   a merge — when none requires a status check. Measured 2026-09-22: homeflare-builds (its
- *   ruleset not deployed yet) and homeflare-desktop have none.
- *
- * ⛔ FIRST-PARTY ONLY: A `run:` STEP AND THE GitHub CLI, NO `uses:` AT ALL. GitHub's own
- *   example ("Automating Dependabot with GitHub Actions") identifies the update with
- *   `dependabot/fetch-metadata`, which the same page marks as "not certified by GitHub".
- *   The group is identified by the branch Dependabot gives it instead, whose format is
- *   dependabot-core's (`branch_namer/dependency_group_strategy.rb`, read at v0.397.0):
- *   `<prefix>/<package manager>/<directory>/<group>-<10 hex MD5 digest>`, with the root
- *   directory collapsing to nothing.
- */
-import { HOMEFLARE_GROUP } from './dependabot.ts';
-import type { RepoShape } from './shape.ts';
-import { runsOn } from './shape.ts';
-import { renderSteps } from './yaml.ts';
-
-/**
- * The branch prefix a job-level `if:` can test with `startsWith`. GitHub's expression
- * language has no regex, so this is the cheap filter that keeps every other pull request
- * from taking a runner slot; `GROUP_BRANCH` is the exact test inside the step.
- */
-export const GROUP_BRANCH_PREFIX: string = `dependabot/bun/${HOMEFLARE_GROUP}-`;
-
-/**
- * ⛔ EXACT, AND FAILS CLOSED. A solo update of `@homeflare/config` is
- *   `dependabot/bun/homeflare/config-0.9.0` and a package named `homeflare-x` would be
- *   `dependabot/bun/homeflare-x-1.2.3`; neither matches. If Dependabot ever changes its
- *   format, the symptom is a bump that waits for a person — never one merged by mistake.
- */
-export const GROUP_BRANCH: string = `^${GROUP_BRANCH_PREFIX}[0-9a-f]{10}$`;
-
-const HEADER = `# Arms auto-merge on Dependabot's @homeflare/* group, and on nothing else.
-#
-# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.
-#    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
-#
-# ★ HOW A KIT RELEASE ARRIVES: the \`${HOMEFLARE_GROUP}\` group in .github/dependabot.yml opens one
-#   pull request; this arms GitHub's auto-merge on it; the ruleset's required checks decide.
-#   Nothing here merges anything itself, and merging deploys nothing.
-# ⛔ NO THIRD-PARTY ACTION. GitHub's own example uses dependabot/fetch-metadata, which its
-#   docs mark "not certified by GitHub"; the group is recognised by its branch name instead.
-# ⛔ NO REQUIRED CHECK ON THE BASE BRANCH, NO ARMING: there \`gh pr merge --auto\` would merge
-#   at once, unchecked. The job fails instead, so the pull request waits for a person.
-# ⚠️ A RENDERER CHANGE STILL NEEDS A PERSON. When a kit release changes what @homeflare/config
-#   renders, the bump fails \`check\` (the drift test) and never goes green. Run
-#   \`bun run repo-shape:refresh\` on Dependabot's branch and push. ⛔ This workflow does not do
-#   it for you: a push made with GITHUB_TOKEN starts no workflow run, so a refreshed commit
-#   would never get the required checks and the pull request would wait forever.
-`;
-
-const TRIGGER = `name: dependabot auto-merge
-
-on:
-  pull_request:
-
-# ⛔ NOTHING AT THE TOP; the one job asks for exactly what \`gh pr merge --auto\` needs.
-permissions: {}
-
-concurrency:
-  group: automerge-\${{ github.ref }}
-  cancel-in-progress: true
-`;
-
-const JOB_NOTE = `  # ⛔ BOTH LOGINS, NOT EITHER. \`user.login\` is who opened the pull request; \`github.actor\` is
-  #   who started this run. A person pushing to Dependabot's branch changes the actor, so
-  #   their commit never arms anything; only Dependabot's own rebases do.`;
-
-const PERMISSIONS_NOTE = `    # ★ WHAT GitHub'S OWN EXAMPLE GRANTS FOR THIS STEP, AND NO MORE. A run Dependabot starts gets
-    #   a read-only GITHUB_TOKEN unless the workflow raises it ("Troubleshooting Dependabot on
-    #   GitHub Actions" → "Changing GITHUB_TOKEN permissions").`;
-
-const ARM = `set -euo pipefail
-if [[ ! "$HEAD_REF" =~ ${GROUP_BRANCH} ]]; then
-  echo "::notice::$HEAD_REF is not the ${HOMEFLARE_GROUP} group's branch; auto-merge not armed"
-  exit 0
-fi
-# ⛔ gh merges a CLEAN or UNSTABLE pull request at once rather than arming it. Only a branch
-#   rule that requires a status check keeps it BLOCKED until the checks have passed.
-required=$(gh api "repos/$GITHUB_REPOSITORY/rules/branches/$BASE_REF" \\
-  --jq '[.[] | select(.type == "required_status_checks")] | length')
-if [ "$required" = 0 ]; then
-  echo "::error::$BASE_REF requires no status check, so gh would merge at once; auto-merge not armed"
-  exit 1
-fi
-# ★ --squash: the house repositories allow squash merges only (declareRepoPolicy).
-gh pr merge --auto --squash "$PR_URL"`;
-
-/** The whole `dependabot-automerge.yml` for a shape. */
-export function renderAutomerge(shape: RepoShape): string {
-  // ⚠️ GitHub ACTIONS EXPRESSIONS, NOT TEMPLATE LITERALS: the runner interpolates `${{ … }}`
-  //   at job time, so they must reach the file verbatim (see security.ts for the same note).
-  // oxlint-disable-next-line no-template-curly-in-string
-  const headRef = '${{ github.head_ref }}';
-  // oxlint-disable-next-line no-template-curly-in-string
-  const baseRef = '${{ github.base_ref }}';
-  // oxlint-disable-next-line no-template-curly-in-string
-  const prUrl = '${{ github.event.pull_request.html_url }}';
-  // oxlint-disable-next-line no-template-curly-in-string
-  const token = '${{ secrets.GITHUB_TOKEN }}';
-  const condition = [
-    "github.event.pull_request.user.login == 'dependabot[bot]'",
-    "github.actor == 'dependabot[bot]'",
-    `startsWith(github.head_ref, '${GROUP_BRANCH_PREFIX}')`,
-  ].join(' && ');
-
-  return `${HEADER}
-${TRIGGER}
-jobs:
-${JOB_NOTE}
-  arm:
-    name: arm auto-merge
-    if: ${condition}
-    runs-on: ${runsOn(shape.runner)}
-${PERMISSIONS_NOTE}
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-${renderSteps(
-  [
-    {
-      env: { BASE_REF: baseRef, GH_TOKEN: token, HEAD_REF: headRef, PR_URL: prUrl },
-      name: 'Arm auto-merge on the homeflare group',
-      run: ARM,
-    },
-  ],
-  3,
-)}
-`;
-}