From 63623cd1b05d0169ad89950a3a9ea476cc7cf3bd Mon Sep 17 00:00:00 2001 From: Thomas Hauschild <7961978+Morgy93@users.noreply.github.com> Date: Sun, 9 Aug 2026 23:46:06 +0200 Subject: [PATCH 1/5] feat: add automated trunk upgrade workflow --- .github/workflows/trunk-upgrade.yml | 42 +++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/trunk-upgrade.yml diff --git a/.github/workflows/trunk-upgrade.yml b/.github/workflows/trunk-upgrade.yml new file mode 100644 index 00000000..09345a53 --- /dev/null +++ b/.github/workflows/trunk-upgrade.yml @@ -0,0 +1,42 @@ +name: Trunk Upgrade + +on: + schedule: + # Weekly on Mondays at 06:00 UTC + - cron: 0 6 * * 1 + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + upgrade: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + + - name: Install Trunk CLI + uses: trunk-io/trunk-action@04ba50e7658c81db7356da96657e6e77f220bfa3 # v1.3.1 + + - name: Upgrade Trunk CLI and linters + run: trunk upgrade -y --include-cli + env: + # Authenticated requests get a higher GitHub API rate limit (pinact). + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Create Pull Request + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff2fa2e423999752927 # v8.1.0 + with: + commit-message: "chore: upgrade trunk linters" + title: "chore: upgrade trunk linters" + body: | + Automated `trunk upgrade -y --include-cli` run. + + Review the linter version changes in `.trunk/trunk.yaml` — new linter + versions may introduce new findings. Run `trunk check -a` and + `trunk fmt` locally if CI reports issues. + branch: chore/trunk-upgrade + delete-branch: true + labels: dependencies From 8a4ec3017c120bb334364023f31f2fd3efd49cfb Mon Sep 17 00:00:00 2001 From: Thomas Hauschild <7961978+Morgy93@users.noreply.github.com> Date: Sun, 9 Aug 2026 23:46:36 +0200 Subject: [PATCH 2/5] feat: enhance dependabot configuration for improved dependency updates --- .github/dependabot.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6386fed4..91d4682e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,3 +4,36 @@ updates: directory: / schedule: interval: daily + labels: + - dependencies + # Major updates land as separate PRs so they can be reviewed individually. + groups: + dev-dependencies: + dependency-type: development + update-types: + - minor + - patch + phpunit: + patterns: + - phpunit/* + - sebastian/* + - myclabs/* + - theseer/* + - phar-io/* + update-types: + - minor + - patch + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + labels: + - dependencies + groups: + github-actions: + patterns: + - "*" + update-types: + - minor + - patch From 324a145ea17afc71bc01d44b192311c766a0de39 Mon Sep 17 00:00:00 2001 From: Thomas Hauschild <7961978+Morgy93@users.noreply.github.com> Date: Mon, 10 Aug 2026 07:24:51 +0200 Subject: [PATCH 3/5] fix: reorder dependabot groups so phpunit group matches first Dependabot applies only the first matching group; the catch-all dev-dependencies group would have swallowed all PHPUnit-ecosystem updates. Review feedback on PR #231. --- .github/dependabot.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 91d4682e..83b1ed6a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,12 +7,9 @@ updates: labels: - dependencies # Major updates land as separate PRs so they can be reviewed individually. + # Note: only the first matching group applies, so the phpunit group must + # come before the catch-all dev-dependencies group. groups: - dev-dependencies: - dependency-type: development - update-types: - - minor - - patch phpunit: patterns: - phpunit/* @@ -23,6 +20,11 @@ updates: update-types: - minor - patch + dev-dependencies: + dependency-type: development + update-types: + - minor + - patch - package-ecosystem: github-actions directory: / From 14eacc043227ca735f7cf194301f5c868bb3119b Mon Sep 17 00:00:00 2001 From: Thomas Hauschild <7961978+Morgy93@users.noreply.github.com> Date: Mon, 10 Aug 2026 07:26:52 +0200 Subject: [PATCH 4/5] fix: annotate create-pull-request pin as floating v8 tag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pinned SHA 98357b1 is the refs/tags/v8 ref, not v8.1.0 — pinact requires the annotation to match the tag the SHA actually points to. Verified with 'pinact run --check' against the GitHub API this time. --- .github/workflows/trunk-upgrade.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trunk-upgrade.yml b/.github/workflows/trunk-upgrade.yml index 09345a53..7585d71d 100644 --- a/.github/workflows/trunk-upgrade.yml +++ b/.github/workflows/trunk-upgrade.yml @@ -27,7 +27,7 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Create Pull Request - uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff2fa2e423999752927 # v8.1.0 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff2fa2e423999752927 # v8 with: commit-message: "chore: upgrade trunk linters" title: "chore: upgrade trunk linters" From 01ce3839652fa66e87adc7a5661b2207663192de Mon Sep 17 00:00:00 2001 From: Thomas Hauschild <7961978+Morgy93@users.noreply.github.com> Date: Mon, 10 Aug 2026 07:31:46 +0200 Subject: [PATCH 5/5] fix: use existing repo label 'Dependencies' (capital D) The label 'dependencies' does not exist in this repo; applying a non-existent label would fail the create-pull-request step and mislabel dependabot PRs. Review feedback on PR #231. --- .github/dependabot.yml | 4 ++-- .github/workflows/trunk-upgrade.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 83b1ed6a..10ca8016 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,7 +5,7 @@ updates: schedule: interval: daily labels: - - dependencies + - Dependencies # Major updates land as separate PRs so they can be reviewed individually. # Note: only the first matching group applies, so the phpunit group must # come before the catch-all dev-dependencies group. @@ -31,7 +31,7 @@ updates: schedule: interval: weekly labels: - - dependencies + - Dependencies groups: github-actions: patterns: diff --git a/.github/workflows/trunk-upgrade.yml b/.github/workflows/trunk-upgrade.yml index 7585d71d..8f8a49e6 100644 --- a/.github/workflows/trunk-upgrade.yml +++ b/.github/workflows/trunk-upgrade.yml @@ -39,4 +39,4 @@ jobs: `trunk fmt` locally if CI reports issues. branch: chore/trunk-upgrade delete-branch: true - labels: dependencies + labels: Dependencies