Automate bot PR maintenance end-to-end

.github/dependabot.yml

@@ -1,5 +1,14 @@
 # Dependabot configuration
 #
+# Notes:
+# - Updates are grouped into a single weekly PR per ecosystem to reduce
+#   review noise and avoid changelog merge conflicts between bot PRs.
+# - The `skip news` label exempts bot PRs from the changelog check
+#   (see .github/workflows/check-release-notes.yml). Their changelog
+#   entries are added in bulk at release time with the help of the
+#   ./cicd_utils/find-unmentioned-prs.sh script.
+# - Bot PRs are auto-merged once approved (see .github/workflows/bot-prs.yml).
+#
 # References:
 # - https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
 #
@@ -8,10 +17,16 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-    labels: [ "github_actions" ]
+      interval: "weekly"
+    labels: [ "github_actions", "skip news" ]
+    groups:
+      github-actions:
+        patterns: [ "*" ]
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
-      interval: "daily"
-    labels: [ "dependencies" ]
+      interval: "weekly"
+    labels: [ "dependencies", "skip news" ]
+    groups:
+      pip:
+        patterns: [ "*" ]

.github/workflows/bot-prs.yml

@@ -0,0 +1,54 @@
+# Automation for PRs opened by trusted bots (dependabot and pre-commit.ci).
+#
+# For every bot PR, this workflow:
+#   1. Adds the `skip news` label, which exempts the PR from the changelog
+#      check (dependabot PRs already get it via .github/dependabot.yml).
+#      The corresponding changelog entries are added in bulk at release
+#      time with the help of ./cicd_utils/find-unmentioned-prs.sh
+#   2. Enables GitHub's native auto-merge (squash). The PR will then merge
+#      automatically as soon as the branch protection requirements are met
+#      (i.e., an approving review plus all required status checks passing).
+#
+# The only human action left is the review itself.
+#
+# Note: If auto-merge is enabled with the default GITHUB_TOKEN, the resulting
+# merge commit will not trigger other workflows (e.g., the CI run on main or
+# the TestPyPI publish). To get those post-merge runs, create a fine-grained
+# PAT with contents:write and pull-requests:write scoped to this repository
+# and store it as the AUTO_MERGE_PAT secret. This workflow falls back to
+# GITHUB_TOKEN when the secret is not set.
+#
+# Security: this workflow runs on pull_request_target but never checks out
+# or executes code from the PR branch.
+#
+name: Bot PRs
+
+on:
+  pull_request_target:
+    types: [ opened, reopened ]
+
+permissions: {}
+
+jobs:
+  automate:
+    name: Label and enable auto-merge
+    if: >-
+      github.event.pull_request.user.login == 'dependabot[bot]' ||
+      github.event.pull_request.user.login == 'pre-commit-ci[bot]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Add 'skip news' label
+        run: gh pr edit "$PR_URL" --add-label 'skip news'
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge (squash)
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.AUTO_MERGE_PAT || secrets.GITHUB_TOKEN }}

cicd_utils/find-unmentioned-prs.sh

@@ -68,6 +68,7 @@ else
     echo "📋 PRs not mentioned in changelog (${#unmentioned_prs[@]} total):"
     echo
 
+    suggested_entries=()
     for pr in "${unmentioned_prs[@]}"; do
         # Get PR title and URL for better readability
         pr_info=$(gh pr view "$pr" --json title,url --jq '{title: .title, url: .url}')
@@ -77,5 +78,13 @@ else
         echo "  #$pr: $pr_title"
         echo "       $pr_url"
         echo
+
+        suggested_entries+=("- ${pr_title} ({gh-pr}\`${pr}\`)")
+    done
+
+    echo "📝 Suggested changelog entries (review and paste under 'Unreleased changes'):"
+    echo
+    for entry in "${suggested_entries[@]}"; do
+        echo "$entry"
     done
 fi

docs/development/release_process.md

@@ -6,7 +6,7 @@
 You need to have push-access to the project's repository to make releases. Therefore, the following release steps are intended to be used as a reference for maintainers or [collaborators](https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-user-account-settings/permission-levels-for-a-personal-account-repository#collaborator-access-for-a-repository-owned-by-a-personal-account) with push-access to the repository.
 :::
 
-1. Review the **`## Unreleased changes`** section at the top of the {repo-file}`docs/reference/changelog.md` file and, if necessary, group and/or split entries into relevant subsections (e.g., _Features_, _Docs_, _Bugfixes_, _Security_, etc.). Take a look at previous release notes for guidance and try to keep the format consistent. You can also use the `./cicd_utils/find-unmentioned-prs.sh` helper script to find merged PRs that were not mentioned in the changelog yet.
+1. Review the **`## Unreleased changes`** section at the top of the {repo-file}`docs/reference/changelog.md` file and, if necessary, group and/or split entries into relevant subsections (e.g., _Features_, _Docs_, _Bugfixes_, _Security_, etc.). Take a look at previous release notes for guidance and try to keep the format consistent. You can also use the `./cicd_utils/find-unmentioned-prs.sh` helper script to find merged PRs that were not mentioned in the changelog yet. Note that PRs opened by trusted bots (e.g., dependabot and pre-commit.ci) are automatically labeled with `skip news` and auto-merged once approved (see {repo-file}`.github/workflows/bot-prs.yml`), so their changelog entries are intentionally deferred to this step: the helper script prints ready-to-paste entries for them (these typically belong under a _CI/CD_ subsection).
 2. [Review](https://github.com/tpvasconcelos/ridgeplot/compare) new usages of `.. versionadded::`, `.. versionchanged::`, and `.. deprecated::` directives that were added to the documentation since the last release. If necessary, update the version numbers in these directives to reflect the new release version.
    * You can determine the latest release version by running `git describe --tags --abbrev=0` on the `main` branch. Based on this, you can determine the next release version by incrementing the relevant _MAJOR_, _MINOR_, or _PATCH_ numbers.
 3. **IMPORTANT:** Remember to switch to the `main` branch and pull the latest changes before proceeding.