chore: consolidate commits for 2026-07-14

Author: patbaumgartner

.github/dependabot.yml

@@ -1,101 +1,95 @@
 version: 2
-
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:00"
-      timezone: "Europe/Zurich"
-    commit-message:
-      prefix: "chore(deps)"
-    labels:
-      - "dependencies"
-      - "github-actions"
-    open-pull-requests-limit: 5
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "docker"
-    directory: "/stack/build"
-    schedule:
-      interval: "daily"
-      time: "01:00"
-      timezone: "Europe/Zurich"
-    commit-message:
-      prefix: "chore(deps)"
-    labels:
-      - "dependencies"
-      - "docker"
-    open-pull-requests-limit: 5
-    groups:
-      build-stack-images:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "docker"
-    directory: "/stack/run"
-    schedule:
-      interval: "daily"
-      time: "01:00"
-      timezone: "Europe/Zurich"
-    commit-message:
-      prefix: "chore(deps)"
-    labels:
-      - "dependencies"
-      - "docker"
-    open-pull-requests-limit: 5
-    groups:
-      run-stack-images:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:00"
-      timezone: "Europe/Zurich"
-    commit-message:
-      prefix: "chore(deps)"
-    labels:
-      - "dependencies"
-      - "java"
-    open-pull-requests-limit: 5
-    groups:
-      spring-boot:
-        patterns:
-          - "org.springframework.boot:*"
-      maven-dependencies:
-        patterns:
-          - "*"
-        exclude-patterns:
-          - "org.springframework.boot:*"
-
-  - package-ecosystem: "maven"
-    directory: "/samples/java-native-image"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "06:00"
-      timezone: "Europe/Zurich"
-    commit-message:
-      prefix: "chore(deps)"
-    labels:
-      - "dependencies"
-      - "java"
-    open-pull-requests-limit: 5
-    groups:
-      spring-boot:
-        patterns:
-          - "org.springframework.boot:*"
-      maven-dependencies:
-        patterns:
-          - "*"
-        exclude-patterns:
-          - "org.springframework.boot:*"
-# manual-trigger: 2026-04-27T06:12Z
+- package-ecosystem: github-actions
+  directory: /
+  schedule:
+    interval: weekly
+    day: monday
+    time: 06:00
+    timezone: Europe/Zurich
+  commit-message:
+    prefix: chore(deps)
+  labels:
+  - dependencies
+  - github-actions
+  open-pull-requests-limit: 5
+  groups:
+    github-actions:
+      patterns:
+      - '*'
+- package-ecosystem: docker
+  directory: /stack/build
+  schedule:
+    interval: daily
+    time: 06:00
+    timezone: Europe/Zurich
+  commit-message:
+    prefix: chore(deps)
+  labels:
+  - dependencies
+  - docker
+  open-pull-requests-limit: 5
+  groups:
+    build-stack-images:
+      patterns:
+      - '*'
+- package-ecosystem: docker
+  directory: /stack/run
+  schedule:
+    interval: daily
+    time: 06:00
+    timezone: Europe/Zurich
+  commit-message:
+    prefix: chore(deps)
+  labels:
+  - dependencies
+  - docker
+  open-pull-requests-limit: 5
+  groups:
+    run-stack-images:
+      patterns:
+      - '*'
+- package-ecosystem: maven
+  directory: /samples/java
+  schedule:
+    interval: weekly
+    day: monday
+    time: 06:00
+    timezone: Europe/Zurich
+  commit-message:
+    prefix: chore(deps)
+  labels:
+  - dependencies
+  - java
+  open-pull-requests-limit: 5
+  groups:
+    spring-boot:
+      patterns:
+      - org.springframework.boot:*
+    maven-dependencies:
+      patterns:
+      - '*'
+      exclude-patterns:
+      - org.springframework.boot:*
+- package-ecosystem: maven
+  directory: /samples/java-native-image
+  schedule:
+    interval: weekly
+    day: monday
+    time: 06:00
+    timezone: Europe/Zurich
+  commit-message:
+    prefix: chore(deps)
+  labels:
+  - dependencies
+  - java
+  open-pull-requests-limit: 5
+  groups:
+    spring-boot:
+      patterns:
+      - org.springframework.boot:*
+    maven-dependencies:
+      patterns:
+      - '*'
+      exclude-patterns:
+      - org.springframework.boot:*

.github/workflows/benchmark.yml

@@ -57,7 +57,7 @@ jobs:
 
       - name: Set up Java (Spring Boot sample only)
         if: matrix.java_version != ''
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: ${{ matrix.java_version }}
@@ -194,7 +194,7 @@ jobs:
 
       - name: Set up Java (Spring Boot sample only)
         if: matrix.java_version != ''
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: ${{ matrix.java_version }}

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,102 @@
+name: Dependabot Auto Merge
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  enable-auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    steps:
+      - name: Approve and enable auto-merge
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const pullNumber = context.payload.pull_request.number;
+            const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+            try {
+              await github.rest.pulls.createReview({
+                owner,
+                repo,
+                pull_number: pullNumber,
+                event: "APPROVE",
+                body: "Auto-approving Dependabot pull request."
+              });
+            } catch (error) {
+              console.log(`Approval skipped: ${error.message}`);
+            }
+
+            const data = await github.graphql(
+              `query($owner: String!, $repo: String!, $pullNumber: Int!) {
+                repository(owner: $owner, name: $repo) {
+                  mergeCommitAllowed
+                  rebaseMergeAllowed
+                  squashMergeAllowed
+                  pullRequest(number: $pullNumber) {
+                    id
+                  }
+                }
+              }`,
+              { owner, repo, pullNumber }
+            );
+
+            let mergeMethod = "SQUASH";
+            if (!data.repository.squashMergeAllowed) {
+              if (data.repository.rebaseMergeAllowed) {
+                mergeMethod = "REBASE";
+              } else if (data.repository.mergeCommitAllowed) {
+                mergeMethod = "MERGE";
+              } else {
+                throw new Error("No merge method is enabled for this repository.");
+              }
+            }
+
+            const mutation = `mutation($pullRequestId: ID!, $mergeMethod: PullRequestMergeMethod!) {
+              enablePullRequestAutoMerge(input: { pullRequestId: $pullRequestId, mergeMethod: $mergeMethod }) {
+                clientMutationId
+              }
+            }`;
+
+            const variables = {
+              pullRequestId: data.repository.pullRequest.id,
+              mergeMethod
+            };
+
+            for (let attempt = 1; attempt <= 6; attempt += 1) {
+              try {
+                await github.graphql(mutation, variables);
+                core.info(`Enabled auto-merge using ${mergeMethod} on attempt ${attempt}.`);
+                return;
+              } catch (error) {
+                const unstable = error.errors?.some((entry) => entry.message?.includes("unstable status")) || error.message?.includes("unstable status");
+                const missingProtection = error.errors?.some((entry) => entry.message?.includes("Protected branch rules not configured")) || error.message?.includes("Protected branch rules not configured");
+
+                if (missingProtection) {
+                  core.info("Skipping auto-merge enablement because the base branch has no protection rules configured.");
+                  return;
+                }
+
+                if (!unstable) {
+                  throw error;
+                }
+
+                if (attempt === 6) {
+                  core.info("Skipping auto-merge enablement because the pull request remained unstable after retries.");
+                  return;
+                }
+
+                core.info(`Pull request still unstable on attempt ${attempt}; retrying in 10 seconds.`);
+                await sleep(10000);
+              }
+            }

.github/workflows/openrewrite.yml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: "25"
@@ -85,7 +85,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: "25"

.github/workflows/quality-gates.yml

@@ -58,7 +58,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Java
-        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
+        uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5
         with:
           distribution: temurin
           java-version: "25"

.github/workflows/scorecard.yml

@@ -44,7 +44,7 @@ jobs:
           publish_results: true
 
       - name: Upload Scorecard SARIF
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         with:
           sarif_file: scorecard-results.sarif
           category: scorecard

.github/workflows/security-scan.yml

@@ -50,14 +50,14 @@ jobs:
           output-file: hadolint-run.sarif
 
       - name: Upload hadolint SARIF (build image)
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         if: always()
         with:
           sarif_file: hadolint-build.sarif
           category: hadolint-build
 
       - name: Upload hadolint SARIF (run image)
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         if: always()
         with:
           sarif_file: hadolint-run.sarif
@@ -89,7 +89,7 @@ jobs:
           github-pat: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy SARIF – filesystem
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         if: always()
         with:
           sarif_file: trivy-fs.sarif
@@ -133,7 +133,7 @@ jobs:
           github-pat: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy SARIF – build stack image
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         if: always()
         with:
           sarif_file: trivy-build-image.sarif
@@ -177,7 +177,7 @@ jobs:
           github-pat: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload Trivy SARIF – run stack image
-        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         if: always()
         with:
           sarif_file: trivy-run-image.sarif