From 269ead43284ca81227db9438fdbcd192998703d3 Mon Sep 17 00:00:00 2001 From: Dmitry Prudnikov Date: Thu, 29 Oct 2026 14:12:06 +0200 Subject: [PATCH 1/5] ci: run CodeQL for dependency pull requests Preserve required analysis names and language coverage through an explicit pull-request workflow with minimal permissions. Closes #26 --- .github/workflows/codeql.yml | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..e9cc8e8 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,39 @@ +name: CodeQL + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + schedule: + - cron: '27 3 * * 2' + +permissions: + contents: read + +jobs: + analyze: + name: Analyze (${{ matrix.language }}) + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + strategy: + fail-fast: false + matrix: + language: [actions, javascript-typescript, rust] + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Initialize CodeQL + uses: github/codeql-action/init@793b778da9c9275a0f276522b27cb5fc14bba279 # v4 + with: + languages: ${{ matrix.language }} + build-mode: none + - name: Analyze + uses: github/codeql-action/analyze@793b778da9c9275a0f276522b27cb5fc14bba279 # v4 + with: + category: /language:${{ matrix.language }} From 9ce556fe1c42948a637cf55c488189ee04a971be Mon Sep 17 00:00:00 2001 From: Dmitry Prudnikov Date: Thu, 29 Oct 2026 14:29:59 +0200 Subject: [PATCH 2/5] ci: auto-merge verified action dependency updates Use authenticated Dependabot metadata and signed bot commits to enable native auto-merge for GitHub Actions updates, including major versions. Require the expected head and retain protected-branch validation. --- .github/workflows/dependabot-auto-merge.yml | 39 +++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..720073d --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,39 @@ +name: Dependabot auto-merge + +on: + pull_request: + branches: [main] + types: [opened, reopened, synchronize] + +permissions: {} + +jobs: + enable: + if: >- + github.event.pull_request.user.login == 'dependabot[bot]' && + github.event.pull_request.head.repo.full_name == github.repository + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + steps: + # This privileged workflow never checks out or executes pull-request code. + # Metadata must come from signed Dependabot commits in this repository. + - name: Verify Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2 + - name: Enable auto-merge for GitHub Actions updates + if: steps.metadata.outputs.package-ecosystem == 'github_actions' + shell: bash + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + PR_NUMBER: ${{ github.event.pull_request.number }} + PR_URL: ${{ github.event.pull_request.html_url }} + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + # The metadata action validates the first commit. Reject any later + # unsigned or human-authored addition before enabling native auto-merge. + gh api --paginate --slurp "repos/$GH_REPO/pulls/$PR_NUMBER/commits" | + jq -e '([.[][]] | length) > 0 and all(.[][]; .author.login == "dependabot[bot]" and .commit.verification.verified == true)' > /dev/null + gh pr merge "$PR_URL" --auto --squash --match-head-commit "$PR_HEAD_SHA" From 8951e0f45961f537e52d0e662ae966d1299fc134 Mon Sep 17 00:00:00 2001 From: Dmitry Prudnikov Date: Thu, 29 Oct 2026 14:32:22 +0200 Subject: [PATCH 3/5] ci: name the required auto-merge admission gate --- .github/workflows/dependabot-auto-merge.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 720073d..4a0b9e0 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -9,6 +9,7 @@ permissions: {} jobs: enable: + name: Dependabot auto-merge admission if: >- github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository From 8d6d6e0233f2914da7f7dc069ca04c0d42b724cd Mon Sep 17 00:00:00 2001 From: Dmitry Prudnikov Date: Thu, 29 Oct 2026 14:37:13 +0200 Subject: [PATCH 4/5] fix(ci): authorize bot merges in trusted context Keep merge admission in a repository-bound metadata-only workflow with bot author, signed commit and exact-head checks. No pull-request code is checked out or executed. Dependabot token permissions require native qualification on its actual PR after merge; this GitHub context cannot be reproduced by a local unit test. --- .github/workflows/dependabot-auto-merge.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 4a0b9e0..d0716ba 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -1,7 +1,7 @@ name: Dependabot auto-merge on: - pull_request: + pull_request_target: branches: [main] types: [opened, reopened, synchronize] @@ -11,6 +11,7 @@ jobs: enable: name: Dependabot auto-merge admission if: >- + github.repository == 'structured-world/omloom' && github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest From 879c5c8b027e2f09b87863eff881d53ca22612b8 Mon Sep 17 00:00:00 2001 From: Dmitry Prudnikov Date: Thu, 29 Oct 2026 14:44:39 +0200 Subject: [PATCH 5/5] fix(ci): bind bot admission to the PR head Use the same admission job for pull_request checks and trusted target authorization. Only the target event can enable native auto-merge. Both GitHub event contexts require live qualification after publication. --- .github/workflows/dependabot-auto-merge.yml | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index d0716ba..d4a0f40 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -1,6 +1,9 @@ name: Dependabot auto-merge on: + pull_request: + branches: [main] + types: [opened, reopened, synchronize] pull_request_target: branches: [main] types: [opened, reopened, synchronize] @@ -24,18 +27,26 @@ jobs: - name: Verify Dependabot metadata id: metadata uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2 - - name: Enable auto-merge for GitHub Actions updates - if: steps.metadata.outputs.package-ecosystem == 'github_actions' + # pull_request records the required check on the PR head. The trusted + # target run repeats admission before it can authorize the native merge. + - name: Verify every commit shell: bash env: GH_TOKEN: ${{ github.token }} GH_REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }} - PR_URL: ${{ github.event.pull_request.html_url }} - PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} run: | # The metadata action validates the first commit. Reject any later # unsigned or human-authored addition before enabling native auto-merge. gh api --paginate --slurp "repos/$GH_REPO/pulls/$PR_NUMBER/commits" | jq -e '([.[][]] | length) > 0 and all(.[][]; .author.login == "dependabot[bot]" and .commit.verification.verified == true)' > /dev/null + - name: Enable auto-merge for GitHub Actions updates + if: >- + github.event_name == 'pull_request_target' && + steps.metadata.outputs.package-ecosystem == 'github_actions' + env: + GH_TOKEN: ${{ github.token }} + PR_URL: ${{ github.event.pull_request.html_url }} + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | gh pr merge "$PR_URL" --auto --squash --match-head-commit "$PR_HEAD_SHA"