frequenz-floss/Dependabot Migrate

Run migration scripts on Dependabot PRs — fetch and execute per-version scripts, commit changes, post a summary, and optionally auto-approve and auto-merge.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jul 2, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: frequenz-floss/gh-action-dependabot-migrate@e93e3b50930132717c9aabdd09413a6737d4b7ef # v1.3.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
script-url-template	URL template for the migration script. Use {version} as a placeholder for the version tag (e.g. v0.15.0). Mutually exclusive with `migration-script` — provide exactly one.	no	""
migration-script	Inline migration script body (Python). The script is saved to a temporary file and executed with `python3 -I` once per version in the upgrade range, exactly like URL-fetched scripts. The current version being migrated is available as the `MIGRATION_VERSION` environment variable. Mutually exclusive with `script-url-template` — provide exactly one.	no	""
token	Token used for pushing migration commits, PR approval, and auto-merge. Must trigger follow-up workflows (merge queue CI, etc.) — typically a GitHub App token or PAT, since GITHUB_TOKEN does not trigger follow-up workflows. If the migration can modify workflow files (.github/workflows/*), this token also needs workflow-write permission. When omitted, migration commits are pushed with GITHUB_TOKEN and no auto-approve or auto-merge is performed. The workflow is responsible for generating this token (e.g. via actions/create-github-app-token in a prior step). When `sign-commits` is "true", this token is also used for GraphQL `createCommitOnBranch` commit creation.	no	""
sign-commits	When "true", create migration commits via GitHub's GraphQL `createCommitOnBranch` mutation so commits are marked as verified when supported (for example with GitHub App tokens). When "false" (default), use local `git commit` and `git push`.	no	false
migration-token	Token exposed to migration scripts as GITHUB_TOKEN and GH_TOKEN. When omitted, the migration script runs with no GitHub credentials at all. The workflow is responsible for generating this token if needed.	no	""
auto-merge-on-changes	When "true", auto-approve and auto-merge even when the migration produced commits. When "false" (default), auto-merge is only enabled for patch-only updates and migrations that produce no file changes; migration commits require a human review. Requires `token` to be set.	no	false
report-title	Heading used for PR comments and job summaries emitted by this action. Do not include Markdown heading markers. When empty, the calling workflow title is used.	no	""
version-iteration	Controls which intermediate versions to run migration scripts for when a multi-version jump is detected. "false" runs only the target version; "major" runs for each major boundary (vX.0.0); "minor" also runs for each minor boundary within the target major; "patch" also runs for each patch within the target minor. When empty (default), falls back to the deprecated `iterate-v0-minors` input for backward compatibility.	no	""
if-no-iterations	Controls what happens when `version-iteration` produces no versions to migrate. "error" fails the action so the unexpected no-op is not missed; "pass" treats it as a clean migration with no file changes. When empty (default), uses "error" — except under the deprecated `iterate-v0-minors` fallback or when neither iteration input is set (implicit v0.x default), where it defaults to "pass" for backward compatibility.	no	""
iterate-v0-minors	Deprecated — use `version-iteration` instead. When "true", v0.x bumps iterate through each intermediate minor version. When "false", only the target version is run. When empty (default), the input is inactive. Mutually exclusive with `version-iteration`.	no	""
python-version	Python version to use for running the migration script.	no	3.14
expected-actor	GitHub actor whose pull requests trigger migration and auto-approval. Used to distinguish bot-triggered events (Dependabot opens or synchronises a PR) from human-triggered label events (intervention resolution). Steps gated by this check: Dependabot metadata fetch (step 5), migration decision (step 6), and patch-only auto-approval (step 22).	no	dependabot[bot]
migrated-label	Label name used to mark that migration has run.	no	migrated
migrated-label-color	Hex colour to use if the migrated-label needs to be created (#RRGGBB).	no	#2B8383
migrated-label-description	Label description to use if the migrated-label needs to be created.	no	Migration script has been run
intervention-pending-label	Label name used when migration requires manual intervention.	no	intervention-pending
intervention-pending-label-color	Hex colour to use if the intervention-pending-label needs to be created (#RRGGBB).	no	#DE36AD
intervention-pending-label-description	Label description to use if the intervention-pending-label needs to be created.	no	Migration requires manual intervention
intervention-done-label	Label name used when manual intervention is completed.	no	intervention-done
intervention-done-label-color	Hex colour to use if the intervention-done-label needs to be created (#RRGGBB).	no	#0E8A16
intervention-done-label-description	Label description to use if the intervention-done-label needs to be created.	no	Manual migration intervention has been completed
auto-merged-label	Label name used when this action enables auto-merge.	no	auto-merged
auto-merged-label-color	Hex colour to use if the auto-merged-label needs to be created (#RRGGBB).	no	#0E8A16
auto-merged-label-description	Label description to use if the auto-merged-label needs to be created.	no	PR was auto-merged by automation

Outputs

name	description
migration_ran	Whether migration has been handled: "true" when script(s) executed, when no versions needed migrating and `if-no-iterations` is "pass", when a previous run already migrated this PR, or when the update is patch-only without `version-iteration`. "false" otherwise.
overall_exit	Consolidated outcome code: "0" when no intervention is needed for this run, "1" when migration or intervention handling requires attention, or when a required pre-check fails.
needs_migration	Whether this run entered the migration flow: "true" for minor/major bumps and patch bumps when `version-iteration` is set, "false" for patch-only bumps without `version-iteration`, already-migrated re-triggers, and other runs that do not enter migration.
commit_made	Whether this run produced a migration commit. "false" when no commit was made.