@homeflare/config 0.9.0 → 0.10.0

package/dist/repo-shape.js

@@ -1,25 +1,107 @@
 // @bun
-// src/repo-shape/shape.ts
-function except(exception) {
-  return {
-    file: exception.file,
-    reason: requireSentence("reason", exception.reason),
-    since: requireIsoDate(exception.since)
-  };
-}
-function extraJob(job) {
-  if (job.steps.length === 0) {
-    throw new Error(`repo-shape: extra job "${job.id}" has no steps`);
-  }
-  return {
-    bun: job.bun ?? true,
-    id: requireJobId(job.id),
-    name: requireNonEmpty("name", job.name),
-    needs: [...job.needs ?? []],
-    reason: requireSentence("reason", job.reason),
-    steps: [...job.steps]
-  };
+// src/repo-shape/dependabot.ts
+var HOMEFLARE_GROUP = "homeflare";
+var HOMEFLARE_PATTERN = "@homeflare/*";
+var THIRD_PARTY_COOLDOWN_DAYS = 7;
+function renderDependabot(shape) {
+  const bunDirs = shape.publishes ? ["/", "/packages/*"] : ["/"];
+  return `# Dependabot for ${shape.repository}.
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Refresh with \`bun run repo-shape:refresh\`.
+#
+# \u26D4 THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
+#   platform feature, not an Action \u2014 a config placed among the workflows is silently
+#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
+#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
+#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
+#
+# \u2605 WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
+#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
+#   that is either safe to take together or needs deciding together.
+#
+# \u2605 THE BILLING LOCK DOES NOT STOP THIS FILE. Dependabot runs as a GitHub-hosted "dynamic"
+#   workflow that GitHub's docs say "does not count towards your included GitHub Actions
+#   minutes"; measured 2026-09-22, a private estate repository's Dependabot job got a hosted
+#   runner 86 minutes after that account's ordinary hosted jobs were refused for billing.
+#   It cannot use the mini anyway: a self-hosted Dependabot runner must be Linux x64 with
+#   Docker, and the mini's runners are arm64 containers with no Docker socket.
+version: 2
+
+updates:
+  # \u2500\u2500 The toolchain (bun.lock) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u26A0\uFE0F BLOCKED UPSTREAM, 2026-09-22: bun 1.4 writes bun.lock \`lockfileVersion\` 2 and
+  #   Dependabot's updater bundles bun 1.3.14, which reads up to 1, so this block fails in
+  #   every estate repository with "Unsupported bun.lock 'lockfileVersion' 2". The fix is
+  #   dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.
+  # \u26D4 ONE BUN BLOCK, SO ONE SCHEDULE. Dependabot refuses two blocks for one ecosystem and
+  #   target branch whose directories overlap, so the \`homeflare\` group cannot be daily
+  #   while the rest stays weekly. The block is daily; \`cooldown\` slows the rest.
+  - package-ecosystem: bun
+    directories:
+${bunDirs.map((dir) => `      - ${dir}`).join(`
+`)}
+    schedule:
+      # \u26A0\uFE0F Dependabot's \`daily\` is Monday to Friday; a weekend kit release lands on Monday.
+      interval: daily
+      time: '09:00'
+      timezone: America/New_York
+    # \u26D4 THE EXCLUDE IS NOT OPTIONAL. Dependabot applies a 3-day cooldown to every version
+    #   update even when this key is absent, so without it a kit release would wait three
+    #   days before its bump opened \u2014 and "daily" would quietly mean "three days late".
+    cooldown:
+      default-days: ${THIRD_PARTY_COOLDOWN_DAYS}
+      exclude: ['${HOMEFLARE_PATTERN}']
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'chore'
+      include: scope
+    labels: [dependencies]
+    groups:
+      # \u2605 FIRST, AND EVERY UPDATE TYPE. A kit release is one set of packages built to work
+      #   together, so they move as one pull request; \`bun run check\` is what reads it, and
+      #   .github/workflows/dependabot-automerge.yml merges it when that is green.
+      #   \u26A0\uFE0F A release that changes what @homeflare/config renders fails the drift test here
+      #   by design; \`bun run repo-shape:refresh\` on the branch is the one-command fix.
+      ${HOMEFLARE_GROUP}:
+        patterns: ['${HOMEFLARE_PATTERN}']
+
+      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
+      # noise unless they fail CI, which is what CI is for.
+      lint-and-format:
+        patterns: ['oxfmt', 'oxlint']
+        update-types: [minor, patch]
+
+      # \u26A0\uFE0F MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
+      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
+      #   did both). These want reading, not merging on green.
+      build-tooling:
+        patterns: ['typescript', '@changesets/*', '@types/bun']
+        update-types: [minor, patch]
+
+  # \u2500\u2500 The workflows themselves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u2605 Actions go stale invisibly: nothing fails, they just keep running old code. The
+  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
+  #   (current: v2, with every input renamed) \u2014 measured 2026-09-15.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: America/New_York
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'ci'
+    labels: [dependencies, github-actions]
+    groups:
+      actions:
+        patterns: ['*']
+        update-types: [minor, patch]
+`;
 }
+
+// src/repo-shape/guards.ts
 var SENTENCE = 12;
 function requireNonEmpty(field, value) {
   const trimmed = value.trim();
@@ -40,12 +122,50 @@ function requireIsoDate(value) {
   }
   return value;
 }
+function requireMajor(value) {
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error(`repo-shape: node must be a positive integer major, got ${value}`);
+  }
+  return value;
+}
+function requireMinutes(value) {
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error(`repo-shape: timeout must be a positive whole minute count, got ${value}`);
+  }
+  return value;
+}
 function requireJobId(value) {
   if (!/^[a-z][a-z0-9_-]*$/.test(value)) {
     throw new Error(`repo-shape: job id must match /^[a-z][a-z0-9_-]*$/, got ${JSON.stringify(value)}`);
   }
   return value;
 }
+
+// src/repo-shape/shape.ts
+function except(exception) {
+  return {
+    file: exception.file,
+    reason: requireSentence("reason", exception.reason),
+    since: requireIsoDate(exception.since)
+  };
+}
+function extraJob(job) {
+  if (job.steps.length === 0) {
+    throw new Error(`repo-shape: extra job "${job.id}" has no steps`);
+  }
+  return {
+    bun: job.bun ?? true,
+    id: requireJobId(job.id),
+    name: requireNonEmpty("name", job.name),
+    needs: [...job.needs ?? []],
+    reason: requireSentence("reason", job.reason),
+    steps: [...job.steps],
+    ...job.timeout === undefined ? {} : { timeout: requireMinutes(job.timeout) }
+  };
+}
+function nodeMajor(shape) {
+  return shape.node === undefined ? undefined : requireMajor(shape.node);
+}
 function runsOn(runner) {
   return runner === "mini" ? "[self-hosted, homeflare-mini]" : "ubuntu-latest";
 }
@@ -101,11 +221,98 @@ function renderSteps(steps, depth) {
 `);
 }
 
+// src/repo-shape/automerge.ts
+var GROUP_BRANCH_PREFIX = `dependabot/bun/${HOMEFLARE_GROUP}-`;
+var GROUP_BRANCH = `^${GROUP_BRANCH_PREFIX}[0-9a-f]{10}$`;
+var HEADER = `# Arms auto-merge on Dependabot's @homeflare/* group, and on nothing else.
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
+#
+# \u2605 HOW A KIT RELEASE ARRIVES: the \`${HOMEFLARE_GROUP}\` group in .github/dependabot.yml opens one
+#   pull request; this arms GitHub's auto-merge on it; the ruleset's required checks decide.
+#   Nothing here merges anything itself, and merging deploys nothing.
+# \u26D4 NO THIRD-PARTY ACTION. GitHub's own example uses dependabot/fetch-metadata, which its
+#   docs mark "not certified by GitHub"; the group is recognised by its branch name instead.
+# \u26D4 NO REQUIRED CHECK ON THE BASE BRANCH, NO ARMING: there \`gh pr merge --auto\` would merge
+#   at once, unchecked. The job fails instead, so the pull request waits for a person.
+# \u26A0\uFE0F A RENDERER CHANGE STILL NEEDS A PERSON. When a kit release changes what @homeflare/config
+#   renders, the bump fails \`check\` (the drift test) and never goes green. Run
+#   \`bun run repo-shape:refresh\` on Dependabot's branch and push. \u26D4 This workflow does not do
+#   it for you: a push made with GITHUB_TOKEN starts no workflow run, so a refreshed commit
+#   would never get the required checks and the pull request would wait forever.
+`;
+var TRIGGER = `name: dependabot auto-merge
+
+on:
+  pull_request:
+
+# \u26D4 NOTHING AT THE TOP; the one job asks for exactly what \`gh pr merge --auto\` needs.
+permissions: {}
+
+concurrency:
+  group: automerge-\${{ github.ref }}
+  cancel-in-progress: true
+`;
+var JOB_NOTE = `  # \u26D4 BOTH LOGINS, NOT EITHER. \`user.login\` is who opened the pull request; \`github.actor\` is
+  #   who started this run. A person pushing to Dependabot's branch changes the actor, so
+  #   their commit never arms anything; only Dependabot's own rebases do.`;
+var PERMISSIONS_NOTE = `    # \u2605 WHAT GitHub'S OWN EXAMPLE GRANTS FOR THIS STEP, AND NO MORE. A run Dependabot starts gets
+    #   a read-only GITHUB_TOKEN unless the workflow raises it ("Troubleshooting Dependabot on
+    #   GitHub Actions" \u2192 "Changing GITHUB_TOKEN permissions").`;
+var ARM = `set -euo pipefail
+if [[ ! "$HEAD_REF" =~ ${GROUP_BRANCH} ]]; then
+  echo "::notice::$HEAD_REF is not the ${HOMEFLARE_GROUP} group's branch; auto-merge not armed"
+  exit 0
+fi
+# \u26D4 gh merges a CLEAN or UNSTABLE pull request at once rather than arming it. Only a branch
+#   rule that requires a status check keeps it BLOCKED until the checks have passed.
+required=$(gh api "repos/$GITHUB_REPOSITORY/rules/branches/$BASE_REF" \\
+  --jq '[.[] | select(.type == "required_status_checks")] | length')
+if [ "$required" = 0 ]; then
+  echo "::error::$BASE_REF requires no status check, so gh would merge at once; auto-merge not armed"
+  exit 1
+fi
+# \u2605 --squash: the house repositories allow squash merges only (declareRepoPolicy).
+gh pr merge --auto --squash "$PR_URL"`;
+function renderAutomerge(shape) {
+  const headRef = "${{ github.head_ref }}";
+  const baseRef = "${{ github.base_ref }}";
+  const prUrl = "${{ github.event.pull_request.html_url }}";
+  const token = "${{ secrets.GITHUB_TOKEN }}";
+  const condition = [
+    "github.event.pull_request.user.login == 'dependabot[bot]'",
+    "github.actor == 'dependabot[bot]'",
+    `startsWith(github.head_ref, '${GROUP_BRANCH_PREFIX}')`
+  ].join(" && ");
+  return `${HEADER}
+${TRIGGER}
+jobs:
+${JOB_NOTE}
+  arm:
+    name: arm auto-merge
+    if: ${condition}
+    runs-on: ${runsOn(shape.runner)}
+${PERMISSIONS_NOTE}
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+${renderSteps([
+    {
+      env: { BASE_REF: baseRef, GH_TOKEN: token, HEAD_REF: headRef, PR_URL: prUrl },
+      name: "Arm auto-merge on the homeflare group",
+      run: ARM
+    }
+  ], 3)}
+`;
+}
 // src/repo-shape/ci.ts
 var BUN_VERSION = "1.4.0";
 var ACTIONLINT_VERSION = "1.7.12";
 var CHECKOUT = "actions/checkout@v7";
 var SETUP_BUN = "oven-sh/setup-bun@v2";
+var SETUP_NODE = "actions/setup-node@v6";
 function runnerNote(shape) {
   if (shape.runner !== "mini") {
     return "# \u26A0\uFE0F RUNS ON GitHub-HOSTED `ubuntu-latest`. Only a public repository should: hosted minutes\n#   are refused for this account's private repos (billing lock, 2026-09-22).\n";
@@ -120,7 +327,7 @@ function runnerNote(shape) {
   ].join(`
 `);
 }
-var HEADER = `# Pull requests: is this code correct?
+var HEADER2 = `# Pull requests: is this code correct?
 #
 # \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
 #    Its input is this repository's \`repo-shape.ts\`. Change that, then:
@@ -133,7 +340,7 @@ var HEADER = `# Pull requests: is this code correct?
 #   share a prologue are steps inside \`check\`, so the install is paid once.
 # \u26D4 EVERY ACTION IS FIRST-PARTY OR THE VENDOR'S OWN, PINNED TO A MAJOR TAG.
 `;
-var TRIGGER = `name: ci
+var TRIGGER2 = `name: ci
 
 on:
   # \u26D4 NO \`push: branches: [main]\`. Every commit reaches main through a pull request whose
@@ -222,23 +429,41 @@ var VERIFY = `if [ "\${{ contains(needs.*.result, 'failure') }}" = "true" ] || \
   echo "one or more required jobs did not succeed: \${{ toJSON(needs.*.result) }}" >&2
   exit 1
 fi`;
-function prologue() {
-  return renderSteps([
-    { uses: CHECKOUT },
+var NODE_NOTE = `      # \u26D4 REAL NODE, NOT BUN'S SHIM, AND ONLY WHERE THE GATE NEEDS IT. The mini's job
+      #   image has no node on PATH (ubuntu-latest always did), so a repository whose own
+      #   \`check\` spawns \`node\` \u2014 or whose framework demands a Node runtime \u2014 fails with
+      #   \`Executable not found in $PATH: "node"\` without this. Declared as \`node:\` in
+      #   repo-shape.ts, so it is one input rather than a hand-edited block per repository.
+      # \u26A0\uFE0F NO PACKAGE-MANAGER CACHE: bun does the installing, so priming npm's cache costs
+      #   time and caches nothing anything here reads.`;
+function prologue(shape) {
+  const node = nodeMajor(shape);
+  const bun = [
     { uses: SETUP_BUN, with: { "bun-version": BUN_VERSION } },
     { run: "bun install --frozen-lockfile" }
-  ], 3);
+  ];
+  if (node === undefined)
+    return renderSteps([{ uses: CHECKOUT }, ...bun], 3);
+  return [
+    renderSteps([{ uses: CHECKOUT }], 3),
+    NODE_NOTE,
+    renderSteps([{ uses: SETUP_NODE, with: { "node-version": node, "package-manager-cache": "false" } }], 3),
+    renderSteps(bun, 3)
+  ].join(`
+`);
 }
-function renderExtraJob(job, on) {
+function renderExtraJob(job, shape, on) {
   const needs = (job.needs ?? []).length === 0 ? "" : `    needs: [${(job.needs ?? []).join(", ")}]
 `;
-  const steps = job.bun === false ? renderSteps([{ uses: CHECKOUT }, ...job.steps], 3) : [prologue(), renderSteps(job.steps, 3)].join(`
+  const timeout = job.timeout === undefined ? "" : `    timeout-minutes: ${job.timeout}
+`;
+  const steps = job.bun === false ? renderSteps([{ uses: CHECKOUT }, ...job.steps], 3) : [prologue(shape), renderSteps(job.steps, 3)].join(`
 `);
   return `  # \u2605 NOT PART OF THE STANDARD SHAPE \u2014 ${job.reason}
   ${job.id}:
     name: ${job.name}
 ${needs}    runs-on: ${on}
-    steps:
+${timeout}    steps:
 ${steps}
 `;
 }
@@ -246,14 +471,14 @@ function renderCi(shape) {
   const on = runsOn(shape.runner);
   const extras = shape.extraJobs ?? [];
   const needs = ["check", "workflows", ...extras.map((job) => job.id)];
-  return `${HEADER}${runnerNote(shape)}${TRIGGER}
+  return `${HEADER2}${runnerNote(shape)}${TRIGGER2}
 jobs:
 ${CHECK_NOTE}
   check:
     name: check
     runs-on: ${on}
     steps:
-${prologue()}
+${prologue(shape)}
 ${renderSteps([{ run: "bun run check" }], 3)}
 
 ${WORKFLOWS_NOTE}
@@ -266,7 +491,7 @@ ${ACTIONLINT_NOTE}
 ${renderSteps([{ name: "Install actionlint (checksum-verified)", run: INSTALL_ACTIONLINT }], 3)}
 ${renderSteps([{ name: "Lint workflows", run: "./actionlint -color" }], 3)}
 
-${extras.map((job) => `${renderExtraJob(job, on)}
+${extras.map((job) => `${renderExtraJob(job, shape, on)}
 `).join("")}${AGGREGATE_NOTE}
   ci:
     name: ci
@@ -313,78 +538,9 @@ self-hosted-runner:
     - homeflare-mini
 `;
 }
-function renderDependabot(shape) {
-  const bunDirs = shape.publishes ? ["/", "/packages/*"] : ["/"];
-  return `# Dependabot for ${shape.repository}.
-#
-# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
-#    Refresh with \`bun run repo-shape:refresh\`.
-#
-# \u26D4 THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
-#   platform feature, not an Action \u2014 a config placed among the workflows is silently
-#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
-#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
-#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
-#
-# \u2605 WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
-#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
-#   that is either safe to take together or needs deciding together.
-version: 2
-
-updates:
-  # \u2500\u2500 The toolchain (bun.lock) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  - package-ecosystem: bun
-    directories:
-${bunDirs.map((dir) => `      - ${dir}`).join(`
-`)}
-    schedule:
-      interval: weekly
-      day: monday
-      time: '09:00'
-      timezone: America/New_York
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'chore'
-      include: scope
-    labels: [dependencies]
-    groups:
-      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
-      # noise unless they fail CI, which is what CI is for.
-      lint-and-format:
-        patterns: ['oxfmt', 'oxlint']
-        update-types: [minor, patch]
-
-      # \u26A0\uFE0F MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
-      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
-      #   did both). These want reading, not merging on green.
-      build-tooling:
-        patterns: ['typescript', '@changesets/*', '@types/bun']
-        update-types: [minor, patch]
-
-  # \u2500\u2500 The workflows themselves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-  # \u2605 Actions go stale invisibly: nothing fails, they just keep running old code. The
-  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
-  #   (current: v2, with every input renamed) \u2014 measured 2026-09-15.
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-      day: monday
-      time: '09:00'
-      timezone: America/New_York
-    open-pull-requests-limit: 5
-    commit-message:
-      prefix: 'ci'
-    labels: [dependencies, github-actions]
-    groups:
-      actions:
-        patterns: ['*']
-        update-types: [minor, patch]
-`;
-}
 // src/repo-shape/security.ts
 var CRON = "41 6 * * 1";
-var HEADER2 = `# Secret scanning, on its own schedule and its own check.
+var HEADER3 = `# Secret scanning, on its own schedule and its own check.
 #
 # \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
 #    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
@@ -394,7 +550,7 @@ var HEADER2 = `# Secret scanning, on its own schedule and its own check.
 #   tomorrow can find a secret committed today), and it needs full history, which the CI
 #   jobs deliberately do not fetch.
 `;
-var TRIGGER2 = `name: security
+var TRIGGER3 = `name: security
 
 on:
   # \u26D4 NO \`push: branches: [main]\`, for the reason ci.yml gives: main only moves by
@@ -445,7 +601,7 @@ function renderSecurity(shape) {
     # \u26D4 THE SCHEDULED RUN GOES TO THE MINI TOO: if the runner daemon is down this queues
     #   rather than failing, so a missed weekly scan is silent. homeflare-mini's
     #   \`ci-runner\` vmalert group is what notices that, not this workflow.` : "";
-  return `${HEADER2}${TRIGGER2}
+  return `${HEADER3}${TRIGGER3}
 jobs:
   secrets:
     name: secret scan${scheduled}
@@ -465,6 +621,7 @@ function renderRepoShape(shape) {
     ".changeset/config.json": renderChangesetConfig(shape),
     ".github/dependabot.yml": renderDependabot(shape),
     ".github/workflows/ci.yml": renderCi(shape),
+    ".github/workflows/dependabot-automerge.yml": renderAutomerge(shape),
     ".github/workflows/security.yml": renderSecurity(shape)
   };
   const actionlint = renderActionlintConfig(shape);
@@ -480,6 +637,7 @@ var RENDERED_PATHS = [
   ".github/actionlint.yaml",
   ".github/dependabot.yml",
   ".github/workflows/ci.yml",
+  ".github/workflows/dependabot-automerge.yml",
   ".github/workflows/security.yml"
 ];
 
@@ -593,8 +751,13 @@ async function repoShapeCli(projectDir, shape, argv) {
 export {
   ACTIONLINT_VERSION,
   BUN_VERSION,
+  GROUP_BRANCH,
+  GROUP_BRANCH_PREFIX,
+  HOMEFLARE_GROUP,
+  HOMEFLARE_PATTERN,
   REFRESH_COMMAND,
   RENDERED_PATHS,
+  THIRD_PARTY_COOLDOWN_DAYS,
   driftInRepoShape,
   except,
   exceptionSummary,
@@ -602,6 +765,7 @@ export {
   isExcepted,
   refreshRepoShape,
   renderActionlintConfig,
+  renderAutomerge,
   renderChangesetConfig,
   renderCi,
   renderDependabot,
@@ -611,5 +775,5 @@ export {
   runsOn
 };
 
-//# debugId=90AE28FCE975727B64756E2164756E21
+//# debugId=2943BDDA9944E35364756E2164756E21
 //# sourceMappingURL=repo-shape.js.map