major: remove backing web app

[Eomm]

fix #103

This PR removes the need for an external application to merge the PRs.

Here is an example of how it shows up: #106

How to upgrade from 2.x to new 3.x

• Update the action version.
• Add the new permissions configuration into your workflow or, instead, you can set the permissions rules on the repository or on the organization.
• If you have customized the api-url you can:
  • Remove the api-url option from your workflow.
  • Turn off the dependabot-merge-action-app application.

Migration example:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # ...

  automerge:
    needs: build
    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
    steps:
-     - uses: fastify/github-action-merge-dependabot@v2.1.1
+     - uses: fastify/github-action-merge-dependabot@v3.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

[simoneb]

fix #103

How to migrate

• If you have customized the api-url you can:

  • Remove the api-url option from your workflow.
  • Turn off the dependabot-merge-action-app application.

One the first point above is something you have to change if you customized it, the second always applies. Mention the changes in order of importance please.

• Add the new permissions configuration into your workflow or, instead, you can set the permissions rules on the repository or on the organization.

We need to show an example here

[simoneb]

Looks awesome, thanks. We need to think about a migration plan. See @mcollina's concerns in the original issue. Do you think they're still valid?
The problem is, if we just release a new major people's builds will break and it may not be obvious to them why they break. On the other hand if we don't publish the new version people won't know it's available.

Matteo was suggesting to rebrand this. If we do, I would like to move it back to the @nearform org though, since in practice we have done all the development, but I'm not sure if he would agree. Nonetheless, NearForm developed it.

[Eomm]

Regarding the rollout.

The main issue is that we don't want auto-merge a major version of this package, regardless of the terget configuration set by the user.
Moreover, we need to manage 2 main uses cases:

1. users that rely on the default external application
2. users that have a custom external installation

So, I think we should act on both sides: the external application and this GHA.

The GHA changes:

• release the 2.4.1 version that does not automerge major PRs for github-action-merge-dependabot when the api_url configuration is not the default one.
• it must set the step as FAILED. The message will be the migration guidelines.
• it would be nice to post a message on the PR with a changelog notice not sure if this would work

The external application changes:

• Skip the approve&merge for the github-action-merge-dependabot@v3 module.
• It should REJECT the PR with a comment that:
  • warn the user to migrate and how to do that
  • warn that the external installation is being turned off in

These changes are not mandatories, since the changes on the GHA should be enough.
But I think the REJECT review is much more visible for the users than the workflow error.

Finally:

• release the v3.0.0
• turn off the external application in

NearForm developed it.

Yeah, I will add the credits for it

[simoneb]

Okay that sounds like a reasonable plan. Can we create a timeline to go through so we know we're not missing any steps? Then we close this issue when all steps are completed.

[simoneb]

shall we not move this check above, right after the check on whether it's a dependabot PR?

[Eomm]

I added this check here after the exclude packages check because it seems less confusing for those users that have added the github-action-merge-dependabot into the exclude option.

[simoneb]

don't we want to fail independently of whether the package would eventually be automerged or not? ok maybe it doesn't make a big difference

[simoneb]

Let's make sure

[simoneb]

where is the migration guide?

[Eomm]

where is the migration guide?

I plan to include the message here #107 (comment) into the GH release: `https://github.com/fastify/github-action-merge-dependabot/releases/tag/v3.0.0

[glensc]

actions stopped working with a 404:

Error: Request failed with status code 404: 
<html><head>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
<title>404 Page not found</title>
</head>
<body text=#000000 bgcolor=#ffffff>
<h1>Error: Page not found</h1>
<h2>The requested URL was not found on this server.</h2>
<h2></h2>
</body></html>

example:

• https://github.com/eventum/eventum/runs/7070732719?check_suite_focus=true