chore: group dependabot updates when minor/patch

- [x] change dependabot config to group dependencies - leave major dependency updates to their own PR so they stand out and are tested correctly - prefix the PRs with `chore(deps)` to adhere to conventional commits - [x] ensure GitHub Actions permissions are explicit and default to read contents Signed-off-by: jmeridth <[email protected]>
procore-oss · Jun 5, 2024 · 755f2e7 · 755f2e7
1 parent 3f057d4
commit 755f2e7
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 5 deletions.
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
@@ -8,3 +8,11 @@ updates:
     labels:
       - "dependabot"
       - "dependencies"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/.github/workflows/auto-assign-author.yaml b/.github/workflows/auto-assign-author.yaml
@@ -3,9 +3,12 @@ name: 'Auto Author Assign'
 on:
   pull_request_target:
     types: [opened, reopened]
-
+permissions:
+  contents: read
 jobs:
   assign-author:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: toshimaru/auto-author-assign@ebd30f10fb56e46eb0759a14951f36991426fed0 # (latest, untagged)

diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
@@ -3,13 +3,13 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '30 1 * * *' # https://crontab.guru/#30_1_*_*_* (everyday at 0130)
-
 permissions:
-  issues: write
-  pull-requests: write
-
+  contents: read
 jobs:
   stale:
+    permissions:
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: actions/stale@3f3b0175e8c66fb49b9a6d5a0cd1f8436d4c3ab6 # (latest, untagged)