Merge me! workflow (swagger-api/swagger-ui)
The Merge me! workflow from swagger-api/swagger-ui, explained and optimized by Latchkey.
CI health: B - good
Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Merge me! workflow from the swagger-api/swagger-ui repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
name: Merge me!
on:
pull_request_target:
branches: [ master, next ]
permissions:
contents: read
jobs:
merge-me:
name: Merge me!
if: github.actor == 'dependabot[bot]'
runs-on: ubuntu-latest
steps:
# This first step will fail if there's no metadata and so the approval
# will not occur.
- name: Dependabot metadata
id: dependabot-metadata
uses: dependabot/fetch-metadata@v3.0.0
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
# Here the PR gets approved.
- name: Approve a PR
if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }}
run: gh pr review --approve "$PR_URL"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GITHUB_TOKEN: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }}
# Finally, tell dependabot to merge the PR if all checks are successful
- name: Instruct dependabot to squash & merge
if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }}
uses: mshick/add-pr-comment@v3
with:
repo-token: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }}
allow-repeats: true
message: |
@dependabot squash and merge
env:
GITHUB_TOKEN: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }}
The same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
name: Merge me! on: pull_request_target: branches: [ master, next ] permissions: contents: read jobs: merge-me: timeout-minutes: 30 name: Merge me! if: github.actor == 'dependabot[bot]' runs-on: latchkey-small steps: # This first step will fail if there's no metadata and so the approval # will not occur. - name: Dependabot metadata id: dependabot-metadata uses: dependabot/fetch-metadata@v3.0.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" # Here the PR gets approved. - name: Approve a PR if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }} run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} GITHUB_TOKEN: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }} # Finally, tell dependabot to merge the PR if all checks are successful - name: Instruct dependabot to squash & merge if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }} uses: mshick/add-pr-comment@v3 with: repo-token: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }} allow-repeats: true message: | @dependabot squash and merge env: GITHUB_TOKEN: ${{ secrets.SWAGGER_BOT_GITHUB_TOKEN }}
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Add a job timeout so a hung step cannot burn hours of runner time.
2 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.
This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.