fix(actions): avoid status event fan-out

chore(deps): bump the github-actions group across 1 directory with 2 updates

.github/workflows/ci.yml

@@ -66,10 +66,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: ${{ env.NODE_VERSION }}
 

.github/workflows/dependabot-auto-merge.yml

@@ -1,43 +1,204 @@
 name: Dependabot Auto Merge
 
 on:
-  pull_request:
-    branches:
-      - main
+  check_suite:
+    types: [completed]
+  workflow_run:
+    workflows:
+      - "CI"
+      - "CodeQL"
+      - "Dependabot Updates"
+      - "Dependency Review"
+      - "Release"
     types:
-      - opened
-      - reopened
-      - synchronize
-      - ready_for_review
+      - completed
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.run_id }}
+  cancel-in-progress: false
 
 permissions:
   contents: write
   pull-requests: write
+  checks: read
+  statuses: read
 
 jobs:
-  enable-auto-merge:
-    name: Approve and enable auto-merge
-    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.draft == false
+  merge:
+    name: Auto-merge Dependabot PRs
     runs-on: ubuntu-latest
     timeout-minutes: 10
-
     steps:
-      - name: Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a
+      - name: Merge Dependabot PRs when checks pass
+        uses: actions/github-script@v9
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
 
-      - name: Approve Dependabot pull request
-        continue-on-error: true
-        run: gh pr review --approve "$PR_URL"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
+            const successfulCheckConclusions = new Set(["success", "skipped", "neutral"]);
+            const successfulStatusStates = new Set(["success"]);
+            const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
-      # Requires repository auto-merge to be enabled in GitHub settings.
-      - name: Enable auto-merge
-        run: gh pr merge --auto --merge "$PR_URL"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
+            const latestBy = (items, keyOf, timeOf) => {
+              const latest = new Map();
+              for (const item of items) {
+                const key = keyOf(item);
+                const itemTime = new Date(timeOf(item) || 0).getTime();
+                const existing = latest.get(key);
+                const existingTime = existing ? new Date(timeOf(existing) || 0).getTime() : -1;
+                if (!existing || itemTime >= existingTime) {
+                  latest.set(key, item);
+                }
+              }
+              return [...latest.values()];
+            };
+
+            const findCandidatePulls = async () => {
+              const pulls = await github.paginate(github.rest.pulls.list, {
+                owner,
+                repo,
+                state: "open",
+                per_page: 100,
+              });
+
+              return pulls.filter((pr) => pr.user?.login === "dependabot[bot]");
+            };
+
+            const getMergeablePullRequest = async (pull_number) => {
+              for (let attempt = 1; attempt <= 6; attempt += 1) {
+                const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
+                if (pr.mergeable !== null) {
+                  return pr;
+                }
+                core.info("PR #" + pull_number + " mergeability is still being computed; retry " + attempt + "/6.");
+                await wait(5000);
+              }
+
+              const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number });
+              return pr;
+            };
+
+            const getSignalState = async (sha) => {
+              const checkRuns = await github.paginate(github.rest.checks.listForRef, {
+                owner,
+                repo,
+                ref: sha,
+                per_page: 100,
+              });
+
+              const statuses = await github.paginate(github.rest.repos.listCommitStatusesForRef, {
+                owner,
+                repo,
+                ref: sha,
+                per_page: 100,
+              });
+
+              const latestChecks = latestBy(
+                checkRuns.filter((run) => run.name !== "Dependabot Auto Merge"),
+                (run) => (run.app?.slug || "unknown") + ":" + run.name,
+                (run) => run.completed_at || run.started_at || run.created_at,
+              );
+              const latestStatuses = latestBy(statuses, (status) => status.context, (status) => status.updated_at || status.created_at);
+
+              const pendingChecks = latestChecks.filter((run) => run.status !== "completed");
+              const failedChecks = latestChecks.filter(
+                (run) => run.status === "completed" && !successfulCheckConclusions.has(String(run.conclusion || "").toLowerCase()),
+              );
+              const failedStatuses = latestStatuses.filter((status) => !successfulStatusStates.has(String(status.state || "").toLowerCase()));
+
+              return {
+                totalSignals: latestChecks.length + latestStatuses.length,
+                pendingChecks,
+                failedChecks,
+                failedStatuses,
+              };
+            };
+
+            const { data: repository } = await github.rest.repos.get({ owner, repo });
+            const mergeMethods = [];
+            if (repository.allow_merge_commit) mergeMethods.push("merge");
+            if (repository.allow_squash_merge) mergeMethods.push("squash");
+            if (repository.allow_rebase_merge) mergeMethods.push("rebase");
+
+            if (mergeMethods.length === 0) {
+              core.info("This repository has no enabled pull request merge methods.");
+              return;
+            }
+
+            const pulls = await findCandidatePulls();
+            if (pulls.length === 0) {
+              core.info("No open Dependabot PRs to evaluate.");
+              return;
+            }
+
+            for (const candidate of pulls) {
+              const pull_number = candidate.number;
+              const pr = await getMergeablePullRequest(pull_number);
+
+              if (pr.user?.login !== "dependabot[bot]") {
+                core.info("PR #" + pull_number + " is no longer a Dependabot PR.");
+                continue;
+              }
+
+              if (pr.state !== "open" || pr.draft) {
+                core.info("PR #" + pull_number + " is not an open, ready PR.");
+                continue;
+              }
+
+              if (pr.mergeable !== true) {
+                core.info("PR #" + pull_number + " is not currently mergeable.");
+                continue;
+              }
+
+              const signalState = await getSignalState(pr.head.sha);
+              if (signalState.totalSignals === 0) {
+                core.info("PR #" + pull_number + " has no checks or statuses yet; skipping.");
+                continue;
+              }
+
+              if (signalState.pendingChecks.length > 0) {
+                core.info("PR #" + pull_number + " still has pending checks: " + signalState.pendingChecks.map((run) => run.name).join(", ") + ".");
+                continue;
+              }
+
+              if (signalState.failedChecks.length > 0 || signalState.failedStatuses.length > 0) {
+                const failedChecks = signalState.failedChecks.map((run) => run.name + "=" + run.conclusion).join(", ");
+                const failedStatuses = signalState.failedStatuses.map((status) => status.context + "=" + status.state).join(", ");
+                core.info("PR #" + pull_number + " is not green. Checks: " + (failedChecks || "none") + ". Statuses: " + (failedStatuses || "none") + ".");
+                continue;
+              }
+
+              let merged = false;
+              let lastError = null;
+              for (const merge_method of mergeMethods) {
+                try {
+                  await github.rest.pulls.merge({ owner, repo, pull_number, merge_method });
+                  core.info("Merged Dependabot PR #" + pull_number + " with " + merge_method + ".");
+                  merged = true;
+                  break;
+                } catch (error) {
+                  lastError = error;
+                  if (error.status === 403 || error.status === 405 || error.status === 409) {
+                    core.info("Cannot merge PR #" + pull_number + " with " + merge_method + ": " + error.message);
+                    continue;
+                  }
+                  throw error;
+                }
+              }
+
+              if (!merged) {
+                core.info("PR #" + pull_number + " could not be merged: " + (lastError?.message || "unknown error") + ".");
+                continue;
+              }
+
+              if (pr.head.repo?.full_name === owner + "/" + repo) {
+                try {
+                  await github.rest.git.deleteRef({ owner, repo, ref: "heads/" + pr.head.ref });
+                  core.info("Deleted branch " + pr.head.ref + ".");
+                } catch (error) {
+                  core.info("Could not delete branch " + pr.head.ref + ": " + error.message);
+                }
+              }
+            }

.github/workflows/dependency-review.yml

@@ -21,9 +21,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Review dependency changes
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
         with:
           config-file: ./.github/dependency-review-config.yml

.github/workflows/release.yml

@@ -41,10 +41,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: https://registry.npmjs.org

README.md

@@ -3,6 +3,7 @@
 **_[汉语](./README.zh.md)_**
 
 [![npm version](https://img.shields.io/npm/v/skvlt)](https://www.npmjs.com/package/skvlt)
+[![npm downloads](https://img.shields.io/npm/dm/skvlt?label=downloads)](https://www.npmjs.com/package/skvlt)
 [![CI](https://img.shields.io/github/actions/workflow/status/xixu-me/skills-vault/ci.yml?branch=main&label=ci)](https://github.com/xixu-me/skills-vault/actions/workflows/ci.yml)
 [![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.11-f9f1e1)](https://bun.sh/)
 [![License](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)

README.zh.md

@@ -3,6 +3,7 @@
 **_[English](./README.md)_**
 
 [![npm version](https://img.shields.io/npm/v/skvlt)](https://www.npmjs.com/package/skvlt)
+[![npm downloads](https://img.shields.io/npm/dm/skvlt?label=downloads)](https://www.npmjs.com/package/skvlt)
 [![CI](https://img.shields.io/github/actions/workflow/status/xixu-me/skills-vault/ci.yml?branch=main&label=ci)](https://github.com/xixu-me/skills-vault/actions/workflows/ci.yml)
 [![Bun](https://img.shields.io/badge/Bun-%3E%3D1.3.11-f9f1e1)](https://bun.sh/)
 [![License](https://img.shields.io/badge/license-MIT-blue)](./LICENSE)

bun.lock

@@ -10,11 +10,6 @@
     },
   },
   "packages": {
-    "prettier": [
-      "prettier@3.8.1",
-      "",
-      { "bin": { "prettier": "bin/prettier.cjs" } },
-      "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
-    ],
-  },
+    "prettier": ["prettier@3.9.6", "", { "bin": { "prettier": "bin/prettier.cjs" } }, "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g=="],
+  }
 }