From 9790f49edd8614ea10ec5a7bca8eb6218ced088c Mon Sep 17 00:00:00 2001
From: jmeridth <jmeridth@gmail.com>
Date: Tue, 4 Jun 2024 18:55:31 -0500
Subject: [PATCH] chore: group dependabot updates when minor/patch

- [x] change dependabot config to group dependencies
  - leave major dependency updates to their own PR so they stand out and are tested correctly
  - prefix the PRs with `chore(deps)` to adhere to conventional commits
- [x] change GitHub Actions to use SHAs instead of tags
  - used [frizbee](https://github.com/stacklok/frizbee)
    - ran `frizbee ghactions -d .github/workflows` locally
    - also fixes formatting

Signed-off-by: jmeridth <jmeridth@gmail.com>
---
 .github/dependabot.yaml                   | 16 ++++++++++++++++
 .github/workflows/auto-assign-author.yaml |  6 ++++--
 procore.gemspec                           |  2 +-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index a69deb7..9dbae21 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -9,6 +9,14 @@ updates:
       - "dependabot"
       - "dependencies"
       - "github-actions"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
   - package-ecosystem: "bundler"
     directory: /
     schedule:
@@ -18,3 +26,11 @@ updates:
       - "dependabot"
       - "dependencies"
       - "bundler"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
diff --git a/.github/workflows/auto-assign-author.yaml b/.github/workflows/auto-assign-author.yaml
index 9cb6711..8eeb911 100644
--- a/.github/workflows/auto-assign-author.yaml
+++ b/.github/workflows/auto-assign-author.yaml
@@ -1,11 +1,13 @@
 name: 'Auto Author Assign'
-
 on:
   pull_request_target:
     types: [opened, reopened]
-
+permissions:
+  contents: read
 jobs:
   assign-author:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: toshimaru/auto-author-assign@v2.1.0
diff --git a/procore.gemspec b/procore.gemspec
index cdde3f6..97ddb0b 100644
--- a/procore.gemspec
+++ b/procore.gemspec
@@ -36,7 +36,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rubocop-performance"
   spec.add_development_dependency "rubocop-rails"
   spec.add_development_dependency "simplecov"
-  spec.add_development_dependency "sqlite3"
+  spec.add_development_dependency "sqlite3", "~>1.4"
   spec.add_development_dependency "webmock"
 
   spec.add_dependency "activesupport", "> 2.4"