luciano/amazon-kinesis-client
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added permissions sections and alert-lookup variable to actions.yml

Browse source
This commit is contained in:
skye rogers 2025-03-24 11:49:14 -07:00
parent 7bdd41ce23
commit 7e721b5822
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
.github/workflows/actions.yml vendored
View file

@ -7,12 +7,18 @@ permissions:
jobs: jobs:
dependabot: dependabot:
permissions:
pull-requests: read
runs-on: ubuntu-latest runs-on: ubuntu-latest
if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'owner/my_repo' if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'owner/my_repo'
steps: steps:
- name: Dependabot metadata - name: Dependabot metadata
id: dependabot-metadata id: dependabot-metadata
uses: dependabot/fetch-metadata@v2 uses: dependabot/fetch-metadata@v2
with:
alert-lookup: true
compat-lookup: true
github-token: "${{ secrets.PAT_TOKEN }}"
- name: Enable auto-merge for Dependabot PRs - name: Enable auto-merge for Dependabot PRs
if: (steps.dependabot-metadata.outputs.cvss == true && update_types == 'minor' || 'patch') if: (steps.dependabot-metadata.outputs.cvss == true && update_types == 'minor' || 'patch')
run: gh pr merge --auto --merge "$PR_URL" run: gh pr merge --auto --merge "$PR_URL"