Repository navigation
feat(config): publish the config schemas as draft-07 under supabase.com/schemas #772
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bot PR auto-merge | ||
|
Check warning on line 1 in .github/workflows/bot-pr-auto-merge.yml
|
||
| on: | ||
| # Only this event lets the job use the auto-approve environment's secret. The job never | ||
| # checks out or runs code from the pull request. | ||
| # jactionlint ignore=dangerous-triggers | ||
| pull_request_target: | ||
| types: [opened, reopened, synchronize, ready_for_review] | ||
| branches: [develop] | ||
| permissions: {} | ||
| jobs: | ||
| approve-and-merge: | ||
| name: Approve and enable auto-merge | ||
| runs-on: ubuntu-latest | ||
| # Other apps (coding agents, CI vendors) also open PRs here and still need a maintainer. | ||
| # Release-notes PRs are published by a maintainer approval and must never merge. Branch sync | ||
| # PRs land by fast-forward on a maintainer approval, never by a squash. | ||
| # The first condition checks who opened the pull request. The second checks who caused this | ||
| # event, so a person pushing to a bot's pull request does not get it approved. | ||
| # jactionlint ignore=bot-conditions | ||
| if: >- | ||
| contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.pull_request.user.login) && | ||
| contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.sender.login) && | ||
| github.event.pull_request.head.repo.full_name == github.repository && | ||
| !github.event.pull_request.draft && | ||
| !startsWith(github.event.pull_request.head.ref, 'release-notes/') && | ||
| github.event.pull_request.head.ref != 'sync/main-into-develop' && | ||
| github.event.pull_request.head.ref != 'sync/develop-into-next' | ||
| # Holds `AUTO_APPROVE_PR_PAT`; the environment only deploys from the default branch. | ||
| environment: auto-approve | ||
| steps: | ||
| # pull_request_target is safe here because this job never checks out PR code. | ||
| - name: Generate token | ||
| id: app-token | ||
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | ||
| with: | ||
| client-id: ${{ vars.GH_APP_CLIENT_ID }} | ||
| private-key: ${{ secrets.GH_APP_PRIVATE_KEY }} | ||
| permission-pull-requests: write | ||
| permission-contents: write | ||
| - name: Assign supabase-oss | ||
| run: gh pr edit --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" --add-assignee supabase-oss | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| # A rewritten PR keeps its approval; skipping it avoids stacking a review per push. | ||
| - name: Approve pull request | ||
| run: | | ||
| set -euo pipefail | ||
| decision="$(GH_TOKEN="$APP_TOKEN" gh pr view --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" --json reviewDecision --jq .reviewDecision)" | ||
| if [ "$decision" != "APPROVED" ]; then | ||
| gh pr review --approve --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" | ||
| fi | ||
| env: | ||
| GH_TOKEN: ${{ secrets.AUTO_APPROVE_PR_PAT }} | ||
| APP_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
| - name: Enable auto-merge | ||
| run: gh pr merge --auto --squash --repo "$GITHUB_REPOSITORY" "$PR_NUMBER" | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| PR_NUMBER: ${{ github.event.pull_request.number }} | ||
