[minor] Check terraform, update readme, actually use dependabot

.github/dependabot.template.yml

@@ -1,17 +1,41 @@
 version: 2
 
 updates:
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    schedule:
-      interval: 'daily'
-
+  ### Test dependabot configs
   - package-ecosystem: 'docker'
+    # Simple globs
     directory: '/test/docker/*/Dockerfile*'
     schedule:
       interval: 'weekly'
+    open-pull-requests-limit: 0
 
   - package-ecosystem: 'npm'
+    # Simple glob + extglob
     directory: '/test/npm/*/{package-lock.json,yarn.lock}'
+    ignore:
+      - dependency-name: '*'
+    schedule:
+      interval: 'daily'
+    open-pull-requests-limit: 0
+
+  - package-ecosystem: 'terraform'
+    # Searches the entire tree, but only matches files with the given name
+    # This actually outputs without a leading slash, but dependabot doesn't seem to care
+    # Note the . is escaped, node-glob doesn't search hidden files by default
+    directory: '\.terraform.lock.hcl'
+    commit-message:
+      prefix: 'terraform'
+    schedule:
+      interval: 'weekly'
+    open-pull-requests-limit: 0
+
+  ### The actual dependabot config for this repo
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'daily'
+
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
       interval: 'daily'

.github/workflows/combine_prs.yml

@@ -0,0 +1,154 @@
+name: 'Combine PRs'
+
+# Controls when the action will run - in this case triggered manually
+on:
+  workflow_dispatch:
+    inputs:
+      branchPrefix:
+        description: 'Branch prefix to find combinable PRs based on'
+        required: true
+        default: 'dependabot'
+      mustBeGreen:
+        description: 'Only combine PRs that are green (status is success)'
+        required: true
+        default: 'false'
+      combineBranchName:
+        description: 'Name of the branch to combine PRs into'
+        required: true
+        default: 'combine-prs-branch'
+      ignoreLabel:
+        description: 'Exclude PRs with this label'
+        required: true
+        default: 'nocombine'
+  schedule:
+    - cron: '5 9 * * 1' # 09:05 UTC on Monday, 5 minutes after the dependabot PRs are created
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "combine-prs"
+  combine-prs:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - uses: actions/github-script@v6
+        id: create-combined-pr
+        name: Create Combined PR
+        with:
+          github-token: ${{secrets.GITHUB_TOKEN}}
+          script: |
+            const pulls = await github.paginate('GET /repos/:owner/:repo/pulls', {
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            });
+            let branchesAndPRStrings = [];
+            let baseBranch = null;
+            let baseBranchSHA = null;
+            for (const pull of pulls) {
+              const branch = pull['head']['ref'];
+              console.log('Pull for branch: ' + branch);
+              if (branch.startsWith('${{ github.event.inputs.branchPrefix || 'dependabot' }}')) {
+                console.log('Branch matched prefix: ' + branch);
+                let statusOK = true;
+                if(${{ github.event.inputs.mustBeGreen || 'false' }}) {
+                  console.log('Checking green status: ' + branch);
+                  const stateQuery = `query($owner: String!, $repo: String!, $pull_number: Int!) {
+                    repository(owner: $owner, name: $repo) {
+                      pullRequest(number:$pull_number) {
+                        commits(last: 1) {
+                          nodes {
+                            commit {
+                              statusCheckRollup {
+                                state
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  }`
+                  const vars = {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pull['number']
+                  };
+                  const result = await github.graphql(stateQuery, vars);
+                  const [{ commit }] = result.repository.pullRequest.commits.nodes;
+                  const state = commit.statusCheckRollup.state
+                  console.log('Validating status: ' + state);
+                  if(state != 'SUCCESS') {
+                    console.log('Discarding ' + branch + ' with status ' + state);
+                    statusOK = false;
+                  }
+                }
+                console.log('Checking labels: ' + branch);
+                const labels = pull['labels'];
+                for(const label of labels) {
+                  const labelName = label['name'];
+                  console.log('Checking label: ' + labelName);
+                  if(labelName == '${{ github.event.inputs.ignoreLabel || 'nocombine' }}') {
+                    console.log('Discarding ' + branch + ' with label ' + labelName);
+                    statusOK = false;
+                  }
+                }
+                if (statusOK) {
+                  console.log('Adding branch to array: ' + branch);
+                  const prString = '#' + pull['number'] + ' ' + pull['title'];
+                  branchesAndPRStrings.push({ branch, prString });
+                  baseBranch = pull['base']['ref'];
+                  baseBranchSHA = pull['base']['sha'];
+                }
+              }
+            }
+            if (branchesAndPRStrings.length == 0) {
+              core.setFailed('No PRs/branches matched criteria');
+              return;
+            }
+            try {
+              await github.rest.git.createRef({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: 'refs/heads/' + '${{ github.event.inputs.combineBranchName || github.job }}',
+                sha: baseBranchSHA
+              });
+            } catch (error) {
+              console.log(error);
+              core.setFailed('Failed to create combined branch - maybe a branch by that name already exists?');
+              return;
+            }
+
+            let combinedPRs = [];
+            let mergeFailedPRs = [];
+            for(const { branch, prString } of branchesAndPRStrings) {
+              try {
+                await github.rest.repos.merge({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  base: '${{ github.event.inputs.combineBranchName || github.job }}',
+                  head: branch,
+                });
+                console.log('Merged branch ' + branch);
+                combinedPRs.push(prString);
+              } catch (error) {
+                console.log('Failed to merge branch ' + branch);
+                mergeFailedPRs.push(prString);
+              }
+            }
+
+            console.log('Creating combined PR');
+            const combinedPRsString = combinedPRs.join('\n');
+            let body = '✅ This PR was created by the Combine PRs action by combining the following PRs:\n' + combinedPRsString;
+            if(mergeFailedPRs.length > 0) {
+              const mergeFailedPRsString = mergeFailedPRs.join('\n');
+              body += '\n\n⚠️ The following PRs were left out due to merge conflicts:\n' + mergeFailedPRsString
+            }
+            const prRes = await github.rest.pulls.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: 'Combined PR',
+              head: '${{ github.event.inputs.combineBranchName || github.job }}',
+              base: baseBranch,
+              body: body
+            });
+            console.log(`Created combined PR at ${prRes.data.html_url} with number ${prRes.data.number}`);

.github/workflows/release.yml

@@ -0,0 +1,22 @@
+on:
+  push:
+    branches:
+      - master
+  repository_dispatch:
+  workflow_dispatch:
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Do release
+        uses: Makeshift/[email protected]
+        with:
+          files: |
+            action.yml
+            dist
+            Readme.md
+          readme: Readme.md

Readme.md

@@ -49,31 +49,49 @@ If these options are not sufficient, please open an issue and let me know.
 ## Quickstart
 
 ### Create a `.github/dependabot.template.yml` file
-
+
+This is just a normal `dependabot.yml` file, but with globs/wildcards in the `directory` field.
+Note that comments will not be transferred to the generated file.
+
   ```yaml
 version: 2
 
 updates:
   - package-ecosystem: 'github-actions'
+    # No globs
     directory: '/'
     schedule:
       interval: 'daily'
 
   - package-ecosystem: 'docker'
+    # Simple globs
     directory: '/test/docker/*/Dockerfile*'
     schedule:
       interval: 'weekly'
 
   - package-ecosystem: 'npm'
+    # Simple glob + extglob
     directory: '/test/npm/*/{package-lock.json,yarn.lock}'
+    ignore:
+      - dependency-name: '*'
     schedule:
       interval: 'daily'
 
+  - package-ecosystem: 'terraform'
+    # Searches the entire tree, but only matches files with the given name
+    # This actually outputs without a leading slash, but dependabot doesn't seem to care
+    # Note the . is escaped, node-glob doesn't search hidden files by default
+    directory: '\.terraform.lock.hcl'
+    commit-message:
+      prefix: 'terraform'
+    schedule:
+      interval: 'weekly'
+
   ```
 
 ### Create a `.github/workflows/generate_dependabot.yml` file
 
-Note that this action does not create a PR or otherwise commit the generated file. You will need to do that yourself.
+The action does not create a PR or otherwise commit the generated file, so we can use another action like peter-evans/create-pull-request to do that.
 
 ```yaml
 name: Generate dependabot.yml
@@ -97,4 +115,12 @@ jobs:
         uses: peter-evans/create-pull-request@v4
 ```
 
-Done.
+Done. Now, whenever you push to the repository, or manually trigger the workflow, a PR will be created with the generated `dependabot.yml` file matching your wildcards if they've changed.
+
+<!-- action-docs-inputs -->
+
+<!-- action-docs-inputs -->
+
+<!-- action-docs-outputs -->
+
+<!-- action-docs-outputs -->