From cc65bb106546b2fa9d994c3cbca247200440a6fb Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 30 Oct 2026 12:43:25 -0700 Subject: [PATCH 1/2] ci(dependabot): move to the v3.1 gate and a 3-day cooldown The gate merges every Dependabot PR whose checks pass, including the named sanity check, as the dependabot-merge-swm App. Version updates wait 3 days; security updates apply at once. Advances smartwatermelon/dev-env#229 --- .github/dependabot.yml | 2 +- .github/workflows/dependabot-auto-merge.yml | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c65cd46..76aa09c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,6 @@ updates: schedule: interval: "weekly" cooldown: - default-days: 7 + default-days: 3 commit-message: prefix: "chore" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 3fedb8e..a800051 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -10,6 +10,9 @@ permissions: jobs: dependabot-auto-merge: - uses: smartwatermelon/github-workflows/.github/workflows/dependabot-auto-merge.yml@dependabot-auto-merge-v2 + uses: smartwatermelon/github-workflows/.github/workflows/dependabot-auto-merge.yml@dependabot-auto-merge-v3.1.0 with: - trusted_namespaces: 'smartwatermelon' + sanity_checks: 'bats' # bats.yml: bats suite + secrets: # these two by name; never `secrets: inherit` + MERGE_APP_CLIENT_ID: ${{ secrets.MERGE_APP_CLIENT_ID }} + MERGE_APP_PRIVATE_KEY: ${{ secrets.MERGE_APP_PRIVATE_KEY }} From 86c436119240a096fd3285bc3a3e6109726e156b Mon Sep 17 00:00:00 2001 From: Claude Code Bot Date: Fri, 30 Oct 2026 13:42:17 -0700 Subject: [PATCH 2/2] ci(dependabot): raise the update cooldown to 7 days Semgrep's p/default rule dependabot-missing-cooldown blocks a cooldown under 7 days. The repos whose CI scans with p/default failed on 3. --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 76aa09c..c65cd46 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,6 +9,6 @@ updates: schedule: interval: "weekly" cooldown: - default-days: 3 + default-days: 7 commit-message: prefix: "chore"