[dschach]

Intent

Let 1 call of the reusable Dependabot workflow apply different approve and merge rules to each dependency type. Before this change, a caller that wanted different rules for production, development, and indirect dependencies had to call the workflow 3 times. Each call is its own job, so every Dependabot event started 3 runners. With the new inputs, the same rules need 1 call, 1 job, and 1 runner.

Changes

Workflow inputs

• 6 new optional string inputs: autoapprove-production, automerge-production, autoapprove-development, automerge-development, autoapprove-indirect, and automerge-indirect.

• Each one is a comma-separated list of major, minor, patch, and security, or none. Spaces are ignored.

• When a list is set, it replaces the autoapprove-* or automerge-* booleans for PRs of that dependency type. When a list is empty (the default), the booleans apply, as before.

Decide step

• Validates all 6 lists. A bad value fails the step and names the input and the value in the job summary.

• Picks the list for the PR's dependency type, and checks the update level and security against it.

• The job summary says which input made each decision, for example "autoapprove-indirect includes minor" or "automerge-indirect (patch) does not include minor".

Security alert lookup

• The lookup step now also runs when any per-type list includes security (it still needs the token secret).

Docs

• README: 6 new rows in the inputs table, and the "Different rules for each dependency type" section now shows the 1-call pattern.

• Workflow comments: the same 1-call example. The multi-call pattern with dependency-types is still described, because it still works.

Tests

• 12 new tests in tests/dependabot-reusable/run_tests.py.

Behavior notes

• No input is removed or renamed, and the new inputs are optional, so existing callers work as before. The existing tests run without the new inputs, which is how an existing caller behaves, and they all pass.

• dependency-types still filters first. A per-type list cannot approve a dependency type that dependency-types excludes.

• A list for one dependency type does not affect PRs of another type.

• A list without security turns off the security rule for that type, even if autoapprove-security or automerge-security is true.

• none is a set list with no levels, so it turns off approve or merge for that type even when the booleans are true.

• The only text change for existing callers is a comma in 1 summary sentence for security updates ("This is a security update, and ...").

Example

jobs:
  dependabot:
    uses: x2od/.github/.github/workflows/dependabot-reusable.yml@main
    with:
      autoapprove-production: patch,security
      automerge-production: patch,security
      autoapprove-development: minor,patch,security
      automerge-development: minor,patch,security
      autoapprove-indirect: minor,patch,security
      automerge-indirect: patch,security

Test plan

• actionlint (with shellcheck) passes on the workflow.

• Prettier passes on all changed files.

• The local test suite passes: 108 tests, 0 failed.

• A caller that uses the new inputs passes actionlint against this version of the workflow. The same check rejects a misspelled input name.

• The "Test Dependabot workflow" CI check passes on this PR.

• After the merge, a caller with 1 call shows 1 job for a Dependabot PR.