E2E Dependency Automation

.releaserc

{
  "plugins": [
    ["@semantic-release/commit-analyzer", {
      "preset": "conventionalcommits",
      "releaseRules": [
        { "breaking": true,   "release": "major" },
        { "revert": true,     "release": "patch" },
        { "type": "build",    "release": "patch" },
        { "type": "docs",     "release": "patch" },
        { "type": "feat",     "release": "minor" },
        { "type": "fix",      "release": "patch" },
        { "type": "perf",     "release": "patch" },
        { "type": "refactor", "release": "patch" }
      ]
    }],
    ["@semantic-release/release-notes-generator", {
      "preset": "conventionalcommits",
      "presetConfig": {
        "types": [
          { "type": "build",    "section": "Build",       "hidden": false },
          { "type": "chore",    "section": "Chores",      "hidden": false },
          { "type": "ci",       "section": "CI/CD",       "hidden": false },
          { "type": "docs",     "section": "Docs",        "hidden": false },
          { "type": "feat",     "section": "Features",    "hidden": false },
          { "type": "fix",      "section": "Bug Fixes",   "hidden": false },
          { "type": "perf",     "section": "Performance", "hidden": false },
          { "type": "refactor", "section": "Refactor",    "hidden": false },
          { "type": "style",    "section": "Code Style",  "hidden": false },
          { "type": "test",     "section": "Tests",       "hidden": false }
        ]
      }
    }],
    "@semantic-release/github",
    "@semantic-release/npm"
  ]
}

README.md

E2E Dependency Automation

• .releaserc: semantic-release config file (this example is very verbose to keep a detailed release log)
• .github/dependabot.yml: dependabot configuration
• .github/workflows/release.yml: uses ahmadnassri/action-semantic-release
• .github/workflows/auto-merge.yml: uses ahmadnassri/action-dependabot-auto-merge

auto-merge.yml

name: auto-merge

on:
  pull_request:

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - uses: ahmadnassri/action-dependabot-auto-merge@v1
        with:
          github-token: ${{ secrets.GH_TOKEN }} # use token for a service acount / or your own

dependabot.yml

version: 2
updates:
  - package-ecosystem: github-actions
    open-pull-requests-limit: 10
    directory: /
    schedule:
      interval: daily

  - package-ecosystem: npm
    open-pull-requests-limit: 10
    directory: /path/to/project/root
    schedule:
      interval: daily

release.yml

name: release

on:
  push:
    branches:
      - master

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - uses: actions/setup-node@v2.1.1

      # release
      - name: semantic-release
        uses: ahmadnassri/action-semantic-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # use a personal acceess token if you want to trigger further workflows
          NPM_TOKEN: ${{ secrets.NPM_TOKEN }} # if publishing to github packages, use GITHUB_TOKEN