Please add an option to distinguish between production, dev dependencies and security fixes about action-dependabot-auto-merge HOT 6 CLOSED

this is the section in the docs for accessing the filesystem path: https://docs.github.com/en/actions/reference/virtual-environments-for-github-hosted-runners#filesystems-on-github-hosted-runners

from action-dependabot-auto-merge.

The kind of dependencies should also be detectable by the PR header, although I'm not sure if this is because I'm using conventional-commits:

and the security label

from action-dependabot-auto-merge.

I use conventional commits to wherever I can ... however I do believe the "form x to y" section is the same no matter what ... that said, dependabot docs are a bit disorganized after the acquisition by github and I can't find a good reference ...

that said ...

• it should be a fairly easy attempt to discover prod-vs-dev dependencies, and safely fall-back to standard behaviour when un-detectable
• this action will also work for other non-node things, so not even sure how those would look ...

I do like the idea of adding granular configuration for this, however, it's not currently a priority for me, so I might not get around to it this week ... in the meantime, PRs are welcome!

couple of quick thoughts:

• the action "inputs" are limited to strings, so, in order to have additional configuration (as a full object) perhaps a config file is needed to be stored in the repo, preferably under .github/auto-merge.yml
• if this is the path to go forward, perhaps adopting the original dependabot syntax .... https://dependabot.com/docs/config-file/#automerged_updates

would be great to see a PR to assist in this setup!

thanks

from action-dependabot-auto-merge.

would be great to see a PR to assist in this setup!

I can give it a shot. The original syntax seems to make sense IMO. Do you know how to read a file from the repo from inside the action? I haven't worked with docker actions yet.

from action-dependabot-auto-merge.

PR is up at #10 :)

from action-dependabot-auto-merge.

🎉 This issue has been resolved in version 2.0.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

from action-dependabot-auto-merge.