ci: make Dependabot PRs merge-ready

.github/dependabot.yml

@@ -44,6 +44,10 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
     labels:
       - "dependencies"
       - "ci"

.github/workflows/ci.yml

@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/codeql.yml

@@ -32,16 +32,16 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/autobuild@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         if: matrix.build-mode == 'autobuild'
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,47 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request:
+
+# Job-scoped write is enough to enable auto-merge on the Dependabot PR.
+permissions: {}
+
+concurrency:
+  group: dependabot-automerge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  automerge:
+    name: Enable auto-merge
+    if: >
+      github.event.pull_request.user.login == 'dependabot[bot]'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write # gh pr merge --auto
+      pull-requests: write # enable auto-merge on the PR
+    steps:
+      - name: Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
+
+      - name: Enable auto-merge for safe updates
+        if: >
+          steps.meta.outputs.update-type == 'version-update:semver-patch'
+          || (
+            steps.meta.outputs.update-type == 'version-update:semver-minor'
+            && steps.meta.outputs.dependency-type != 'direct:production'
+          )
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          deny='googleapis/release-please-action golangci/golangci-lint-action @earendil-works/pi-tui dependabot/fetch-metadata'
+          names="${{ steps.meta.outputs.dependency-names }}"
+          for blocked in $deny; do
+            case " $names " in
+              *" $blocked "*) echo "skip auto-merge: $blocked"; exit 0 ;;
+            esac
+          done
+          gh pr merge --auto --squash "$PR_URL"

.github/workflows/dependabot-fmt.yml

@@ -22,7 +22,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/release.yml

@@ -22,7 +22,7 @@
       tag: ${{ steps.release.outputs.tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve release tag
         id: release
@@ -34,13 +34,13 @@
           fi
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v6.0.9
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: pnpm
+          package-manager-cache: false
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -71,7 +71,7 @@
 
       - name: Read release notes
         id: notes
         run: |
           TAG="${{ steps.release.outputs.tag }}"
           NOTES_FILE="docs/release-notes/${TAG}.md"
           if [ -f "$NOTES_FILE" ]; then
@@ -105,7 +105,7 @@
           args: --target aarch64-apple-darwin
 
       - name: Upload DMG artifact
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: openloop-${{ steps.release.outputs.tag }}-macos-dmg
           path: |

pnpm-workspace.yaml

@@ -20,3 +20,7 @@ onlyBuiltDependencies:
 allowBuilds:
   esbuild: true
   lefthook: true
+
+overrides:
+  "undici@>=7 <7.29.0": "7.29.0"
+  "nanoid@>=3 <3.3.17": "3.3.17"