Bump actions/checkout from 6 to 7 #240
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dependabot PRs merge themselves once CI passes. The master ruleset requires | |
| # the ci-success check, so a bump that breaks the build stays open for a human | |
| # instead of landing. | |
| name: Auto-Merge Dependabot PRs | |
| on: pull_request | |
| # Dependabot-triggered runs get a read-only token unless it is widened here. | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fetch Dependabot metadata | |
| id: metadata | |
| uses: dependabot/fetch-metadata@v3 | |
| # proj4 is the only runtime dependency, so it is the only major bump that | |
| # can change what consumers of this package get. Dev tooling is covered by | |
| # lint, typecheck, build and test across the CI matrix. | |
| - name: Enable auto-merge | |
| if: >- | |
| steps.metadata.outputs.update-type != 'version-update:semver-major' | |
| || steps.metadata.outputs.dependency-type == 'direct:development' | |
| run: gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |