chore: automate safe Dependabot updates

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+
+updates:
+  # Wait for routine releases to stabilize before Dependabot proposes them.
+  # GitHub intentionally bypasses cooldowns for known vulnerability fixes.
+  - package-ecosystem: npm
+    directories:
+      - '/'
+      - '/playground'
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+      semver-patch-days: 7
+      semver-minor-days: 14
+      semver-major-days: 30
+    open-pull-requests-limit: 5
+    assignees:
+      - sadjow
+    reviewers:
+      - sadjow

.github/settings.yml

@@ -4,6 +4,7 @@ repository:
   has_projects: false
   has_wiki: true
   default_branch: main
+  allow_auto_merge: true
   allow_squash_merge: true
   allow_merge_commit: false
   allow_rebase_merge: false
@@ -12,6 +13,12 @@ repository:
 branches:
   - name: main
     protection:
+      required_status_checks:
+        strict: true
+        contexts:
+          - 'build (20)'
+          - 'build (22)'
+
       required_pull_request_reviews:
         required_approving_review_count: 1
 

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,40 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    if: >-
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.repository == 'stackbuilders/nuxt-utm'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Read Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7
+        with:
+          github-token: '${{ secrets.GITHUB_TOKEN }}'
+
+      - name: Approve patch and minor updates
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr review --approve "$PR_URL"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          PR_URL: '${{ github.event.pull_request.html_url }}'
+
+      - name: Enable squash auto-merge for patch and minor updates
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}'
+          PR_URL: '${{ github.event.pull_request.html_url }}'

.github/workflows/main.yml

@@ -1,6 +1,13 @@
 name: CI
 
-on: [push, workflow_dispatch]
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   build:
@@ -10,21 +17,22 @@ jobs:
       image: mcr.microsoft.com/playwright:v1.57.0-jammy
 
     strategy:
+      fail-fast: false
       matrix:
         node-version: [20, 22]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: Cache node modules
         id: cache-npm
-        uses: actions/cache@v3
+        uses: actions/cache@v6
         with:
           path: '**/node_modules'
           key: ${{ runner.os }}-node-${{ matrix.node-version }}-${{ hashFiles('**/yarn.lock') }}
@@ -40,7 +48,7 @@ jobs:
         run: yarn list
 
       - name: Install dependencies
-        run: yarn install
+        run: yarn install --frozen-lockfile
 
       - run: yarn lint --max-warnings 0
 
@@ -49,3 +57,11 @@ jobs:
 
       - name: Execute tests
         run: yarn test
+
+      - name: Install playground dependencies
+        working-directory: playground
+        run: yarn install --frozen-lockfile
+
+      - name: Build playground from its lockfile
+        working-directory: playground
+        run: yarn build