From b03c5f498ca47daeeaa51c0480d4df767d652064 Mon Sep 17 00:00:00 2001 From: Karl Bauer Date: Sat, 10 Oct 2026 21:06:55 +0200 Subject: [PATCH 1/2] ci(dependabot): removed the paths filter of the auto-merge caller The caller only started for changes to the Dockerfile, so pip (pyproject.toml) and docker-compose (docker-compose.e2e.yml) PRs never reached docker-maintenance-dependabot.yml: no job, no annotation, the PR just stayed open. Without the filter every Dependabot PR gets an explicit decision from the module. Why this is safe: * required-workflows stays docker-release.yml. Its pull_request paths already cover Dockerfile, pyproject.toml and docker-compose*.yml, and its PR run genuinely exercises each of them: pytest installs from pyproject.toml, the image build runs the pytest gate, and the e2e round trips start the server images of docker-compose.e2e.yml. * GitHub Actions updates and any change under .github/ stay manual by the module's own guard. * Merge settings, permissions and merge-update-types (patch) are unchanged. The header no longer claims the merge triggers docker-release.yml: the merge is made with GITHUB_TOKEN, which starts no push workflow. --- .github/workflows/docker-maintenance.yml | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/.github/workflows/docker-maintenance.yml b/.github/workflows/docker-maintenance.yml index 9f90b86..f5e0a3d 100644 --- a/.github/workflows/docker-maintenance.yml +++ b/.github/workflows/docker-maintenance.yml @@ -1,10 +1,18 @@ # ============================================================================= -# Docker Maintenance — Auto-merge Dependabot PRs (base image) +# Docker Maintenance — Auto-merge Dependabot PRs (every ecosystem) # ============================================================================= -# When Dependabot opens a PR bumping the base image in ./Dockerfile -# (python:3.14-alpine), this workflow auto-approves and merges it after -# validation passes, which then triggers docker-release.yml to build and push -# the updated image. +# Every Dependabot PR reaches this workflow (no paths: filter), so each one +# gets an explicit decision and annotation instead of silently staying open. +# A PR is merged only after the pull_request run of docker-release.yml passed +# on its head commit - pytest, the e2e backup round trips and the image build: +# +# docker Dockerfile the image is built from it +# pip pyproject.toml pytest, image build (pytest gate) +# docker-compose docker-compose.e2e.yml the round trips start its servers +# github-actions .github/workflows/** never merged: a CI change +# +# A PR whose files do not start docker-release.yml stays open as "not +# tested". The merge is made with GITHUB_TOKEN and starts no push workflow. # ============================================================================= name: 🔧 Docker Maintenance @@ -12,8 +20,6 @@ name: 🔧 Docker Maintenance on: pull_request: types: [opened, synchronize, reopened, ready_for_review] - paths: - - 'Dockerfile' permissions: contents: write From 7ec23b7a1de5bfb6ea047048bae101a3f04f366f Mon Sep 17 00:00:00 2001 From: Karl Bauer Date: Sat, 10 Oct 2026 21:07:27 +0200 Subject: [PATCH 2/2] ci(dependabot): removed the redundant actions-maintenance caller actions-maintenance.yml called the same docker-maintenance-dependabot module, filtered on .github/workflows/**, for GitHub Actions updates only. The module never merges those (a CI change cannot be vouched for by its own CI), so this caller only ever wrote the "left open" annotation. docker-maintenance.yml now starts for every Dependabot PR, GitHub Actions updates included, and writes that same annotation. Keeping both would start the module twice on every GitHub Actions PR. Its job-level concurrency group (docker-maintenance-dependabot-pr-, cancel in progress) is shared repository-wide, so one of the two runs would be cancelled and leave a cancelled check on the PR. Nothing that worked is lost: GitHub Actions PRs still get exactly one explicit decision and stay a manual merge. --- .github/workflows/actions-maintenance.yml | 34 ----------------------- 1 file changed, 34 deletions(-) delete mode 100644 .github/workflows/actions-maintenance.yml diff --git a/.github/workflows/actions-maintenance.yml b/.github/workflows/actions-maintenance.yml deleted file mode 100644 index e5a9f5e..0000000 --- a/.github/workflows/actions-maintenance.yml +++ /dev/null @@ -1,34 +0,0 @@ -# ============================================================================= -# Actions Maintenance — Auto-merge Dependabot PRs (GitHub Actions) -# ============================================================================= -# When Dependabot opens a PR bumping a GitHub Action version inside -# .github/workflows/** (e.g. actions/checkout, actions/setup-python), this -# workflow auto-approves and enables native auto-merge. GitHub merges once all -# required status checks pass. -# -# Mirrors docker-maintenance.yml (base image) — same reusable module, scoped to -# the workflow files instead of the Dockerfile. Keeps external Action pins from -# silently drifting out of date (the checkout@v5 → @v7 drift that surfaced as a -# stale open PR is exactly what this closes automatically going forward). -# ============================================================================= - -name: ⚙️ Actions Maintenance - -on: - pull_request: - types: [opened, synchronize, reopened, ready_for_review] - paths: - - '.github/workflows/**' - -permissions: - contents: write - pull-requests: write - -jobs: - maintenance: - name: Auto-merge Dependabot PRs - uses: bauer-group/automation-templates/.github/workflows/docker-maintenance-dependabot.yml@main - with: - merge-method: 'squash' - auto-approve: true - secrets: inherit