ci: add GitHub Actions CI and dependabot auto-merge

- Add CI workflow with svelte-check, lint, and build
- Add dependabot auto-merge for minor/patch updates
- Update .node-version from 20.11.0 to 22
- Add packageManager field to enforce pnpm 10.25.0 via Corepack

commit: 1f891be02cc22baea7072e21e4d1a5f49c4ca01a
author: Kit · 10mo ago · 2025-12-15 06:31 UTC
parent: c1ee1ec
signature: SSH UnverifiedSHA256:3RGv7q1rcg0JUU2CjMAhwZcyGvcCDmFuxQQT8Z18wLA · arch-ssh This key is not trusted for the committer email

4 files · +51 -2

A .github/workflows/ci.yml +23 -0

@@ -0,0 +1,23 @@
	1	+	name: CI
	2	+
	3	+	on:
	4	+	push:
	5	+	branches: [main]
	6	+	pull_request:
	7	+	branches: [main]
	8	+
	9	+	jobs:
	10	+	check:
	11	+	runs-on: ubuntu-latest
	12	+	steps:
	13	+	- uses: actions/checkout@v5
	14	+	- uses: pnpm/action-setup@v4
	15	+	# version comes from packageManager field in package.json
	16	+	- uses: actions/setup-node@v4
	17	+	with:
	18	+	node-version: '22'
	19	+	cache: 'pnpm'
	20	+	- run: pnpm install --frozen-lockfile
	21	+	- run: pnpm run check
	22	+	- run: pnpm run lint
	23	+	- run: pnpm run build

@@ -0,0 +1,23 @@
	1	+	name: CI
	2	+
	3	+	on:
	4	+	push:
	5	+	branches: [main]
	6	+	pull_request:
	7	+	branches: [main]
	8	+
	9	+	jobs:
	10	+	check:
	11	+	runs-on: ubuntu-latest
	12	+	steps:
	13	+	- uses: actions/checkout@v5
	14	+	- uses: pnpm/action-setup@v4
	15	+	# version comes from packageManager field in package.json
	16	+	- uses: actions/setup-node@v4
	17	+	with:
	18	+	node-version: '22'
	19	+	cache: 'pnpm'
	20	+	- run: pnpm install --frozen-lockfile
	21	+	- run: pnpm run check
	22	+	- run: pnpm run lint
	23	+	- run: pnpm run build

A .github/workflows/dependabot-auto-merge.yml +25 -0

@@ -0,0 +1,25 @@
	1	+	name: Dependabot Auto-merge
	2	+
	3	+	on:
	4	+	pull_request:
	5	+
	6	+	permissions:
	7	+	contents: write
	8	+	pull-requests: write
	9	+
	10	+	jobs:
	11	+	dependabot:
	12	+	runs-on: ubuntu-latest
	13	+	if: github.actor == 'dependabot[bot]'
	14	+	steps:
	15	+	- name: Dependabot metadata
	16	+	id: metadata
	17	+	uses: dependabot/fetch-metadata@v2
	18	+	with:
	19	+	github-token: "${{ secrets.GITHUB_TOKEN }}"
	20	+	- name: Enable auto-merge for minor/patch
	21	+	if: steps.metadata.outputs.update-type == 'version-update:semver-minor' \|\| steps.metadata.outputs.update-type == 'version-update:semver-patch'
	22	+	run: gh pr merge --auto --squash "$PR_URL"
	23	+	env:
	24	+	PR_URL: ${{ github.event.pull_request.html_url }}
	25	+	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

@@ -0,0 +1,25 @@
	1	+	name: Dependabot Auto-merge
	2	+
	3	+	on:
	4	+	pull_request:
	5	+
	6	+	permissions:
	7	+	contents: write
	8	+	pull-requests: write
	9	+
	10	+	jobs:
	11	+	dependabot:
	12	+	runs-on: ubuntu-latest
	13	+	if: github.actor == 'dependabot[bot]'
	14	+	steps:
	15	+	- name: Dependabot metadata
	16	+	id: metadata
	17	+	uses: dependabot/fetch-metadata@v2
	18	+	with:
	19	+	github-token: "${{ secrets.GITHUB_TOKEN }}"
	20	+	- name: Enable auto-merge for minor/patch
	21	+	if: steps.metadata.outputs.update-type == 'version-update:semver-minor' \|\| steps.metadata.outputs.update-type == 'version-update:semver-patch'
	22	+	run: gh pr merge --auto --squash "$PR_URL"
	23	+	env:
	24	+	PR_URL: ${{ github.event.pull_request.html_url }}
	25	+	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

M .node-version +1 -1

@@ -1,1 +1,1 @@
1		-	20.11.0⏎̸
	1	+	22⏎̸

@@ -1,1 +1,1 @@
1	-	20.11.0⏎̸	1	+	22⏎̸

M package.json +2 -1


@@ -69,5 +69,6 @@
69	69		"uuid": "^11.1.0",
70	70		"xp.css": "^0.2.6",
71	71		"zod": "^4.1.13"
72		-	}
	72	+	},
	73	+	"packageManager": "pnpm@10.25.0+sha512.5e82639027af37cf832061bcc6d639c219634488e0f2baebe785028a793de7b525ffcd3f7ff574f5e9860654e098fe852ba8ac5dd5cefe1767d23a020a92f501"
73	74		}


@@ -69,5 +69,6 @@
69		"uuid": "^11.1.0",	69		"uuid": "^11.1.0",
70		"xp.css": "^0.2.6",	70		"xp.css": "^0.2.6",
71		"zod": "^4.1.13"	71		"zod": "^4.1.13"
72	-	}	72	+	},
			73	+	"packageManager": "pnpm@10.25.0+sha512.5e82639027af37cf832061bcc6d639c219634488e0f2baebe785028a793de7b525ffcd3f7ff574f5e9860654e098fe852ba8ac5dd5cefe1767d23a020a92f501"
73		}	74		}