Auto-rebuild & auto-merge theme-asset Dependabot PRs (+ verify check)

[CybotTM]

Problem

packages/typo3-docs-theme/ commits its built frontend assets (assets/js/, resources/public/). They drift out of sync when a contributor forgets to rebuild, or when Dependabot bumps a build dependency — Dependabot can't rebuild the assets (this is what made the manual follow-up #1264 necessary).

Changes

1. check-built-assets.yaml — required check verify: on every PR, rebuilds the theme and fails if the committed assets don't match a fresh build. PRs not touching the theme short-circuit to success, so the check can be required without blocking unrelated PRs. Also runs on push to main and in the merge queue.
2. dependabot-rebuild-assets.yaml — on a Dependabot theme bump: rebuilds the assets, commits them back as a GitHub-signed (Verified) commit via a GitHub App, then enables auto-merge for patch/minor updates.
3. pr-auto-merge.yaml — excludes theme PRs from the generic Dependabot auto-merge; the workflow above handles them after the rebuild commit lands.
4. Docs pointer in Documentation/Developer/ThemeCustomization.rst.

Required repository settings

• GitHub App with Contents: write + Pull requests: write, exposed as secrets APP_ID / APP_PRIVATE_KEY (same names as reusable-backport.yml).
• Allow auto-merge enabled.
• Branch protection requiring the verify check.

Security

dependabot-rebuild-assets.yaml uses pull_request_target (same convention as pr-auto-merge.yaml). Guards: actor gated to dependabot[bot]; checkout pinned to the PR head SHA; lockfile-only diff guard; npm ci --ignore-scripts; read-only GITHUB_TOKEN; App token minted only after the build; commit created via createCommitOnBranch, so it is Verified and re-triggers verify.

Residual risk (accepted): patch/minor theme bumps merge without a human in the loop, so a compromised dependency's build-time code runs and its output merges. For a manual checkpoint, drop the "Enable auto-merge" step.

Validation

Proven end-to-end on a fork: non-theme PR → verify skips green; stale assets → verify blocks; Dependabot bump → Verified rebuild commit → verify re-runs → auto-merge with correct assets on main.

[garvinhicking]

So, "allow auto merge" is enabled. The App secrets should exist. I'm not sure what you mean with "verify status" though.

The only "verify" I can find under branch protection is the one here:

and I don't think we can require that...

[CybotTM]

@garvinhicking

"verify" status check means the "verify" job:

https://github.com/TYPO3-Documentation/render-guides/pull/1265/changes#diff-31e507d3ed5388405d0382e860458b4c02af7444aa1084a8aed89f3c5da70d36R22

It must be required to ensure the PR does not get (auto-)merged when it fails.

You may only be able to set it after merge.

And regarding the "signed commits", IMO they should be required along with signed-off commits.
git commit --gpg-sign --signoff ... (git commit -s -S ...) is not that hard.

You can easily enable it for all commits:

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

after registering your ssh key in GitHub → SSH and GPG keys → Signing keys
and your commit email git config user.email must match one of your verified emails in GitHub.

[CybotTM]

I will check failing "Main / Validate monorepo structure (pull_request)Failing after 36s"

[CybotTM]

Rebased onto main and extended.

The [BUGFIX] Use the valid 'ignore' key in dependabot.yml commit dropped out of the branch — #1346 has since landed the same ignore block on main, so .github/dependabot.yml is now identical to it and this PR no longer touches that file.

Two gaps the branch had, both from things that happened after it was opened in May:

Advisory merges bypassed it. Fixes from a temporary private fork arrive on main as direct commits, never as a pull request here, so a pull_request-only trigger cannot see them. That is not hypothetical — it is how 0.40.0 came to ship theme assets built eleven days before the fixes it was tagged for (#1353).

The merge queue would have stalled. main gained a merge queue in #1326. A required status check without a merge_group trigger never reports on a queued merge, so every queued merge times out — the same failure mode this file's own header warns about for paths filters.

Both triggers are added. The base sha now comes out of the event payload via jq instead of being interpolated into the script, and an event that carries no base sha — a push — is verified in full rather than skipped.

Checked locally: actionlint clean, actionlint -shellcheck clean, yamllint reports the same 11 findings as before the change. The base-sha extraction was exercised against synthetic pull_request, merge_group and push payloads, which resolve to the PR base, the merge-group base, and full verification respectively.