feat(state,ui): theme preference persistence + live switching #24
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependabot auto-merge | |
| # pull_request_target runs in the base-branch context so GITHUB_TOKEN has | |
| # write access. Actor check below ensures only Dependabot triggers this. | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| permissions: {} | |
| jobs: | |
| auto-merge: | |
| runs-on: ubuntu-latest | |
| if: github.event.pull_request.user.login == 'dependabot[bot]' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| steps: | |
| # Pinned to commit SHA — floating tags are unsafe on pull_request_target | |
| # with write permissions (supply chain attack surface). v2 = 21025c7 | |
| - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 | |
| id: meta | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| # patch + minor: always auto-merge — backward-compatible by semver contract | |
| # Excludes github-actions (handled by dedicated step below to avoid duplicate calls) | |
| - name: Auto-merge patch and minor updates | |
| if: | | |
| (steps.meta.outputs.update-type == 'version-update:semver-patch' || | |
| steps.meta.outputs.update-type == 'version-update:semver-minor') && | |
| steps.meta.outputs.package-ecosystem != 'github-actions' | |
| run: | | |
| gh pr review --approve "$PR_URL" -b "Automated: patch/minor dependency update" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # major dev deps: auto-merge — no production runtime impact | |
| # Excludes github-actions (handled by dedicated step below to avoid duplicate calls) | |
| - name: Auto-merge major dev dependency updates | |
| if: | | |
| steps.meta.outputs.update-type == 'version-update:semver-major' && | |
| steps.meta.outputs.dependency-type == 'direct:development' && | |
| steps.meta.outputs.package-ecosystem != 'github-actions' | |
| run: | | |
| gh pr review --approve "$PR_URL" -b "Automated: major dev dependency update" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # Docker image updates: auto-merge — Docker build smoke test gates these | |
| - name: Auto-merge Docker image updates | |
| if: | | |
| steps.meta.outputs.update-type == 'docker-tag-update' || | |
| steps.meta.outputs.update-type == 'docker-digest-update' | |
| run: | | |
| gh pr review --approve "$PR_URL" -b "Automated: Docker image update" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # GitHub Actions updates: auto-merge — CI workflow changes, no runtime impact | |
| # Handles all semver tiers for actions (patch/minor/major all safe to auto-merge) | |
| - name: Auto-merge GitHub Actions updates | |
| if: steps.meta.outputs.package-ecosystem == 'github-actions' | |
| run: | | |
| gh pr review --approve "$PR_URL" -b "Automated: GitHub Actions update" | |
| gh pr merge --auto --squash "$PR_URL" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # major prod deps: label for awareness, require manual merge | |
| # Excludes github-actions (already handled above, never reaches this step) | |
| - name: Label major production dependency updates for manual review | |
| if: | | |
| steps.meta.outputs.update-type == 'version-update:semver-major' && | |
| steps.meta.outputs.dependency-type != 'direct:development' && | |
| steps.meta.outputs.package-ecosystem != 'github-actions' | |
| run: gh pr edit "$PR_URL" --add-label "major-update" | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |