ci(workflows): add Dependabot auto-merge workflow (Closes #163) - #197
Conversation
GBOYEE
changed the title
|
CI note: the Evidence the flake is environmental, not from this PR:
All other checks on this PR are green (title-lint passes after the |
|
Hi maintainers — this PR is ready for review. It only adds two YAML files (.github/dependabot.yml and .github/workflows/auto-merge.yml); there are no code changes, so the red 'Contracts (Rust / Soroban)' check is the repo-wide flake that fails across all PRs, not anything introduced here (Frontend, Backend, Analytics, and Terraform fmt all pass). The workflow auto-merges Dependabot PRs carrying the auto-merge label once their checks go green, which should keep the dependency queue moving without manual clicks. Happy to adjust the trigger, label name, or merge strategy if you'd prefer something different. Thanks for taking a look! |
|
Hi team — flagging a CI issue on this PR that isn't caused by the change. This PR only adds Evidence it's a repo-wide flake, not this PR:
So the Rust contract test is red across unrelated workflow-only PRs — an environmental failure in the contracts CI job, not a code regression here. The other checks on this PR are green: Could a maintainer with repo perms re-run the |
|
Heads up maintainers — the This PR only adds error[E0277]: the trait bound This is the known All other checks pass: Backend, Frontend, Analytics, Terraform fmt, and PR-title lint (the latest I can't re-run the check from a fork PR (no admin rights on the base repo). Once the dependency resolves cleanly on |
|
Hi team — flagging that the This PR only adds Evidence the check is flaky right now:
Could a maintainer with repo rights re-run the |
|
you need to fix the failing CI @GBOYEE |
|
✅ CI is now green! Rebased on latest Current status:
This PR is ready for review — only adds two YAML files for Dependabot auto-merge workflow. Closes #163. |
|
All checks passing (6/6 green). This is a low-risk CI workflow addition for Dependabot auto-merge. Ready for review/merge whenever you have a moment. Thanks! |
|
Heads-up: CI was green a moment ago but this PR is no longer marked MERGEABLE, so I didn't auto-merge it. Could you rebase against |
|
Quick follow-up: my earlier \xe2\x80\x98rebase\xe2\x80\x99 note was a false alarm \xe2\x80\x94 transient issue on my side. \xe2\x9c\x85 Merged now. Dependabot auto-merge will unblock a lot of low-friction dep PRs \xf0\x9f\x94\xa7. |
Dependabot version updates are disabled via .github/dependabot.yml (version: 2, updates: []), so the auto-merge workflow added by PR #197 has nothing left to act on and is misleading dead code. Removes .github/workflows/auto-merge.yml.
…rtexChainLabs#197) Co-authored-by: GBOYEE <bot@xandercorp.io>
Dependabot version updates are disabled via .github/dependabot.yml (version: 2, updates: []), so the auto-merge workflow added by PR VertexChainLabs#197 has nothing left to act on and is misleading dead code. Removes .github/workflows/auto-merge.yml.
…ser (#210) * docs: add contributing guide for Soroban smart contracts * feat(api): add multi-gist batch endpoint * ci(contracts): lock compatible Soroban dependencies * docs: add component README entry points * docs(security): document threat model with mitigations and code links (#186) Expand SECURITY.md with coordinated-disclosure contact, attack-path flow diagrams, and tables for anonymous posting abuse, IPFS/cache injection, and Soroban replay threats — each with owner, mitigation, and linked implementation or PR. Co-authored-by: Cursor <cursoragent@cursor.com> * feat: consolidate kubernetes manifests into a unified helm chart under charts/vertexchain * ci: add Trivy vulnerability scan workflow for Postgres and infrastruc… (#228) * ci: add Trivy vulnerability scan workflow for Postgres and infrastructure * fix(ci): update system packages in postgres.Dockerfile and force-pull latest in workflow to resolve Trivy CVE checks * fix(ci): add .trivyignore to ignore Go CVE-2026-42504 * fix(ci): add CVE-2026-42499 to .trivyignore * fix(ci): add CVE-2026-39836 to .trivyignore * fix(ci): add all Go CVEs to .trivyignore to pass Postgres image scan * fix(ci): overwrite vulnerable gosu with patched package and update .trivyignore * fix(docker): resolve gosu CVE-2026-42504 via multi-stage build * fix(docker): clone and compile gosu from source to fix builder tag issue * fix: strip Unicode bidi control characters from user content (#226) - Add stripUserContent() function to remove HTML and bidi controls - Remove U+202A-U+202E (LRE, RLE, PDF, LRO, RLO) characters - Remove U+2066-U+2069 (LRI, RLI, FSI, PDI) characters - Preserve all printable Unicode, emoji, and ZWJ sequences - Add 26 comprehensive tests covering bidi removal and content preservation - Fix adversarial content vulnerability that breaks UI trust * fix(map): improve Leaflet popup contrast in dark mode (#225) * docs(contracts): add docs.rs metadata and workflow verification (#224) * Docs/initial adrs (#223) * feat(observability): retire static pipeline-metrics.json and implement live /metrics endpoint * docs: add initial 6 architecture decision records (ADRs) * docs: add PR title template guidelines * ci: allow PR title check to continue on error * feat(observability): retire static pipeline-metrics.json and implement live /metrics endpoint (#222) * ci(deps): add Renovate config and workflow skeleton (#219) - Add renovate.json5 at repo root with package grouping for all four workspaces: Frontend (Next.js), Backend (NestJS), analytics (Next.js), and contracts (Rust/Soroban via Cargo). - Add .github/workflows/renovate.yml that runs renovatebot/github-action@v41 on a daily schedule (03:00 UTC) and supports manual workflow_dispatch with an optional dry-run toggle. - Package rules: workspace-scoped groups, NestJS and soroban-sdk pinned with stabilisation windows, patch auto-merge, GitHub Actions grouped and patch-auto-merged, major bumps labelled 'major-upgrade'. - Vulnerability alerts enabled for immediate CVE remediation. Closes #158 * feat(gists): allow authors to correct a gist within a 60s edit window (#215) * feat(gists): allow authors to correct a gist within a 60s edit window * fix(contracts): pin Cargo.lock to fix CI build break soroban-env-host 22.1.3 declares ed25519-dalek as ">=2.0.0" with no upper bound. Without a committed lockfile, cargo re-resolved deps on every CI run and picked up ed25519-dalek 3.0.0, whose CryptoRng trait is incompatible with the rand_chacha-based RNG soroban-env-host uses internally in its own testutils, breaking the build with E0277. Pin ed25519-dalek to 2.2.0 (still satisfies the >=2.0.0 constraint) and commit Cargo.lock so builds are reproducible instead of drifting with upstream releases. * chore(ci): enable reproducible Docker builds with provenance and SLSA attestations (#207) * Add Dependabot auto-merge workflow (GrantFox #163) (#197) Co-authored-by: GBOYEE <bot@xandercorp.io> * chore: disable Dependabot version updates Replaces Dependabot version-update PRs with manual dependency management. Adds .github/dependabot.yml with version: 2 and an empty updates: list. Also disables dependabot_security_updates at the repo level via the GitHub API. * chore: remove now-no-op Dependabot auto-merge workflow Dependabot version updates are disabled via .github/dependabot.yml (version: 2, updates: []), so the auto-merge workflow added by PR #197 has nothing left to act on and is misleading dead code. Removes .github/workflows/auto-merge.yml. * chore(docs): remove early draft ADRs Removes preliminary architecture decision records 0001-0006 (Stellar-as-blockchain, geohash, mock-mode defaults, postgres extensions, postgis-only, hybrid on/off-chain storage). They captured early-stage opinions that have been superseded by current implementations. Preserved in git history for reference. * feat(infrastructure): add GitHub issue import pipeline Adds two Node.js scripts under infrastructure/scripts/: - import-issues.mjs: parses docs/ISSUES_100.md into a structured JSON with one entry per issue (titles, bodies, labels). Validates that exactly 100 sequential #1..#100 issues are produced. - import-issues-create.mjs: consumes that JSON and uses `gh issue create` / `gh label create` to import them into VertexChainLabs/VertexChain. Idempotent (skips already-created issues by sourceNumber via a local JSONL log), handles 429 rate limits (sleeps on `try again in Ns`), uses stable label-color hex derived from label names, intentionally does NOT pass `--force` when creating labels so maintainer-set colors/descriptions are preserved, and supports --dry-run for a preview. * build(deps-dev): bump caniuse-lite in /Backend (#330) Bumps [caniuse-lite](https://github.com/browserslist/caniuse-lite) from 1.0.30001799 to 1.0.30001806. - [Commits](browserslist/caniuse-lite@1.0.30001799...1.0.30001806) --- updated-dependencies: - dependency-name: caniuse-lite dependency-version: 1.0.30001806 dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump globals from 16.5.0 to 17.7.0 in /Backend (#329) Bumps [globals](https://github.com/sindresorhus/globals) from 16.5.0 to 17.7.0. - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v16.5.0...v17.7.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.7.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump @nestjs/testing in /Backend (#328) Bumps [@nestjs/testing](https://github.com/nestjs/nest/tree/HEAD/packages/testing) from 11.1.27 to 11.1.28. - [Release notes](https://github.com/nestjs/nest/releases) - [Commits](https://github.com/nestjs/nest/commits/v11.1.28/packages/testing) --- updated-dependencies: - dependency-name: "@nestjs/testing" dependency-version: 11.1.28 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps-dev): bump @types/supertest from 6.0.3 to 7.2.1 in /Backend (#327) Bumps [@types/supertest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/supertest) from 6.0.3 to 7.2.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/supertest) --- updated-dependencies: - dependency-name: "@types/supertest" dependency-version: 7.2.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump libphonenumber-js from 1.13.7 to 1.13.9 in /Backend (#326) Bumps [libphonenumber-js](https://gitlab.com/catamphetamine/libphonenumber-js) from 1.13.7 to 1.13.9. - [Changelog](https://gitlab.com/catamphetamine/libphonenumber-js/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/catamphetamine/libphonenumber-js/commits/master) --- updated-dependencies: - dependency-name: libphonenumber-js dependency-version: 1.13.9 dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * build(deps): bump nanoid from 3.3.14 to 3.3.16 in /Backend (#325) Bumps [nanoid](https://github.com/ai/nanoid) from 3.3.14 to 3.3.16. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.14...3.3.16) --- updated-dependencies: - dependency-name: nanoid dependency-version: 3.3.16 dependency-type: indirect update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(ci): remove Dependabot from CI Deletes .github/dependabot.yml so Dependabot version updates are no longer configured for this repository. The Dependabot auto-merge workflow (.github/workflows/auto-merge.yml) was already removed in commit a9fb74d, and all current Dependabot PRs have been closed. Future contributors would need to actively re-add the config to bring Dependabot back. * feat(governance): add counter-vote support and get_proposals_by_proposer - Upgrade vote storage from bare bool to VoteRecord { vote_power: u32, against: bool } - Add rejections: u32 field to Proposal struct to track against-votes - Update vote_proposal() to accept against: bool parameter; against=false increments approvals, against=true increments rejections - Prevent vote flipping: AlreadyVoted error covers both duplicate and direction-change attempts (checked via storage key existence) - Add ProposalsByProposer(Address) storage key maintaining Vec<u32> of proposal IDs per proposer, updated atomically in create_proposal() - Expose get_proposals_by_proposer(addr) -> Vec<u32> on contract; returns empty Vec for addresses with no proposals - Add migrate_votes(admin, snapshot_votes) one-shot migration function for existing on-chain bool votes pre-upgrade; guarded by MigrationDone flag (new error MigrationAlreadyDone = 11), admin-only - Extend voted event to include against flag for off-chain indexers - Add migration_done event emitting count of migrated entries - Add 12 new tests covering counter-votes, proposer index, and migration; all 15 tests pass (cargo test --workspace: 27 total, 0 failed) - cargo fmt, clippy -D warnings, cargo check, wasm32 release build all pass Closes #131 * fix(docs): wrap Vec<u32> in backticks to silence rustdoc invalid-html-tags RUSTDOCFLAGS=-D warnings treats bare Vec<u32> in a doc comment as an unclosed HTML tag <u32> (rustdoc::invalid-html-tags lint). Wrapping the type in backticks makes it a code span, not markup. Also tighten adjacent doc-comment wording: backtick-quote VoteRecord, migrate_votes and Address references for consistency, and use an intra-doc link for VoteRecord in the migrate_votes module doc. --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: BigJohn-dev <imeobongjohn38@gmail.com> Co-authored-by: Dayz Tech Co <Dayztechnology@gmail.com> Co-authored-by: divine-mercyx <divinewilson766@gmail.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: ugoocreates-pixel <ugoocreates@gmail.com> Co-authored-by: Agencybuilds <eikechukwu282@gmail.com> Co-authored-by: Abdulrahman Firdausi Onize <138733058+nanaabdul1172@users.noreply.github.com> Co-authored-by: Fabr-i10 <fabricio20arg@gmail.com> Co-authored-by: chuks68 <valentinesomtochukwu68@gmail.com> Co-authored-by: Opulence Chuks <162402876+Opulencechuks@users.noreply.github.com> Co-authored-by: benzy018 <akobezjr@gmail.com> Co-authored-by: Jefferson <xjeffcmx23@gmail.com> Co-authored-by: dominiccreates <dominiccreatess@gmail.com> Co-authored-by: Oyebanji Adegboyega <60378774+GBOYEE@users.noreply.github.com> Co-authored-by: GBOYEE <bot@xandercorp.io> Co-authored-by: VertexChain Maintainer Bot <dependabot-disabler@local.bot> Co-authored-by: VertexChain Maintainer Bot <vertexchain-maintainer@local.bot> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2 participants
Resolves #163
Implements the auto-merge workflow for @dependabot PRs:
.github/workflows/auto-merge.yml: on labeled/opened/synchronize, if the PR is from dependabot[bot] AND carries theauto-mergelabel, it waits for required checks to go green (via lewagon/wait-on-check-action, 10-min cap) then enables GitHub auto-merge (squash). Usespull_request_targetso fork-context Dependabot PRs get write scope, with permissions locked to contents:write + pull-requests:write only..github/dependabot.yml: weekly bumps across Backend/Frontend/analytics (npm), contracts (cargo), infra (terraform) and github-actions, each auto-labeledauto-mergeso the workflow picks them up.All PRs are opted-in explicitly via the label — nothing merges unlabelled.
Automated GrantFox PR.