From e21801d4551418a15415deaa41a313a7342bf879 Mon Sep 17 00:00:00 2001 From: Danny Steenman Date: Mon, 5 Oct 2026 12:09:04 +0200 Subject: [PATCH] ci: remove Dependabot auto-approve and auto-merge workflow Dependabot PRs are now reviewed and merged manually, so the projen auto-approve workflow, its auto-merge overrides, and the auto-approve Dependabot label are no longer needed. --- .gitattributes | 1 - .github/dependabot.yml | 1 - .github/workflows/auto-approve.yml | 33 ------------------------------ .gitignore | 1 - .projen/files.json | 1 - .projenrc.py | 32 ++--------------------------- src/bin/cicd_helper.py | 2 +- 7 files changed, 3 insertions(+), 68 deletions(-) delete mode 100644 .github/workflows/auto-approve.yml diff --git a/.gitattributes b/.gitattributes index 9cfdbf9..aec5f68 100644 --- a/.gitattributes +++ b/.gitattributes @@ -3,7 +3,6 @@ * text=auto eol=lf /.gitattributes linguist-generated /.github/dependabot.yml linguist-generated -/.github/workflows/auto-approve.yml linguist-generated /.github/workflows/cdk-deploy-dev.yml linguist-generated /.github/workflows/cdk-deploy-test.yml linguist-generated /.github/workflows/cdk-validate.yml linguist-generated diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 947c0bf..8424111 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,7 +12,6 @@ updates: - dependency-name: projen labels: - dependencies - - auto-approve groups: default: patterns: diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml deleted file mode 100644 index d5002b9..0000000 --- a/.github/workflows/auto-approve.yml +++ /dev/null @@ -1,33 +0,0 @@ -# ~~ Generated by projen. To modify, edit .projenrc.py and run "uv run projen". - -name: auto-approve -on: - pull_request_target: - types: - - labeled - - opened - - synchronize - - reopened - - ready_for_review -jobs: - approve: - runs-on: ubuntu-latest - permissions: - pull-requests: write - contents: write - if: contains(github.event.pull_request.labels.*.name, 'auto-approve') && (github.event.pull_request.user.login == 'dependabot' || github.event.pull_request.user.login == 'dependabot[bot]') - steps: - - id: auto_08f238e2 - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - PR_NUMBER: ${{ github.event.pull_request.number }} - run: gh pr review --approve "$PR_NUMBER" --repo "$GH_REPO" - - name: Checkout - uses: actions/checkout@v7 - with: - persist-credentials: false - - name: Enable Pull Request Automerge - run: gh pr merge --merge --auto "${{ github.event.pull_request.number }}" - env: - GH_TOKEN: ${{ secrets.PROJEN_GITHUB_TOKEN }} diff --git a/.gitignore b/.gitignore index 9e07a12..d456670 100644 --- a/.gitignore +++ b/.gitignore @@ -12,7 +12,6 @@ node_modules/ !/.projen/deps.json !/.projen/files.json !/.github/workflows/pull-request-lint.yml -!/.github/workflows/auto-approve.yml !/pyproject.toml __pycache__/ *.py[cod] diff --git a/.projen/files.json b/.projen/files.json index aa55eb8..75fb5f7 100644 --- a/.projen/files.json +++ b/.projen/files.json @@ -2,7 +2,6 @@ "files": [ ".gitattributes", ".github/dependabot.yml", - ".github/workflows/auto-approve.yml", ".github/workflows/cdk-deploy-dev.yml", ".github/workflows/cdk-deploy-test.yml", ".github/workflows/cdk-validate.yml", diff --git a/.projenrc.py b/.projenrc.py index f9e40dc..e676399 100644 --- a/.projenrc.py +++ b/.projenrc.py @@ -9,7 +9,6 @@ from projen.awscdk import AwsCdkPythonApp from src.bin.cicd_helper import ( - GITHUB_ACTIONS, cdk_validate_workflow, github_cicd, pin_github_actions, @@ -79,9 +78,6 @@ }, }, }, - auto_approve_options={ - "allowed_usernames": ["dependabot", "dependabot[bot]"], - }, git_ignore_options={ "ignore_patterns": [ "__pycache__", @@ -122,7 +118,7 @@ gh = project.github -# Keep projen-managed workflows (auto-approve, pull-request-lint) on the same action versions +# Keep projen-managed workflows (pull-request-lint) on the same action versions pin_github_actions(gh) # Validate the CDK app offline on every pull request (no AWS credentials required) @@ -144,7 +140,7 @@ {"dependency-name": "aws-cdk"}, {"dependency-name": "projen"}, ], - "labels": ["dependencies", "auto-approve"], + "labels": ["dependencies"], "groups": { "default": { "patterns": ["*"], @@ -156,30 +152,6 @@ }, ) -# Add auto-merge step to the auto-approve workflow -auto_approve_workflow = project.try_find_object_file( - ".github/workflows/auto-approve.yml" -) -if auto_approve_workflow: - auto_approve_workflow.add_override("jobs.approve.permissions.contents", "write") - # Add checkout step before the merge step - auto_approve_workflow.add_override( - "jobs.approve.steps.1", - { - "name": "Checkout", - "uses": GITHUB_ACTIONS["checkout"], - "with": {"persist-credentials": False}, - }, - ) - auto_approve_workflow.add_override( - "jobs.approve.steps.2", - { - "name": "Enable Pull Request Automerge", - "run": 'gh pr merge --merge --auto "${{ github.event.pull_request.number }}"', - "env": {"GH_TOKEN": "${{ secrets.PROJEN_GITHUB_TOKEN }}"}, - }, - ) - # Loop through each environment in target_accounts for env, account in target_accounts.items(): if account: # Check if account is not None diff --git a/src/bin/cicd_helper.py b/src/bin/cicd_helper.py index 6a98a8d..7fc4039 100644 --- a/src/bin/cicd_helper.py +++ b/src/bin/cicd_helper.py @@ -1,7 +1,7 @@ from projen import github # Pinned GitHub Actions used by every workflow in this repo. `.projenrc.py` registers these -# with projen's actions provider so projen-managed workflows (auto-approve, pull-request-lint) +# with projen's actions provider so projen-managed workflows (pull-request-lint) # render the same versions as the workflows built here. GITHUB_ACTIONS = { "checkout": "actions/checkout@v7",