From 5d2d10a5686d0cd66dc27f0d6d984c6e22ef8831 Mon Sep 17 00:00:00 2001
From: Defang Agent <140542220+defangdevs@users.noreply.github.com>
Date: Fri, 13 Nov 2026 14:38:01 -0700
Subject: [PATCH 1/2] ci: add required CI gate

---
 .github/workflows/dependabot-automerge.yml | 17 +++++++++++++++--
 .github/workflows/test-scripts.yml         | 18 +++++++++++++-----
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index ebc625e3..05f99d3a 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -17,10 +17,22 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
+      # Sample dependency updates need a human until changed samples can be
+      # tested without exposing deployment credentials to Dependabot PRs.
+      - name: Check whether sample files changed
+        id: scope
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          safe=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --jq '[.[][] | select(.filename | startswith("samples/"))] | length == 0')
+          echo "safe=$safe" >> "$GITHUB_OUTPUT"
+
       - name: Approve patch and minor updates
         if: |
+          steps.scope.outputs.safe == 'true' && (
           steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+          steps.metadata.outputs.update-type == 'version-update:semver-minor')
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
@@ -28,8 +40,9 @@ jobs:
 
       - name: Enable auto-merge for patch and minor updates
         if: |
+          steps.scope.outputs.safe == 'true' && (
           steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+          steps.metadata.outputs.update-type == 'version-update:semver-minor')
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
diff --git a/.github/workflows/test-scripts.yml b/.github/workflows/test-scripts.yml
index 9a59a801..69526a23 100644
--- a/.github/workflows/test-scripts.yml
+++ b/.github/workflows/test-scripts.yml
@@ -5,11 +5,6 @@ permissions:
 
 on:
   pull_request:
-    paths:
-      - "scripts/**"
-      - "templates/**"
-      - "samples/**/compose.yaml"
-      - "samples/**/compose.yml"
   push:
     branches:
       - main
@@ -66,3 +61,16 @@ jobs:
           script: |
             const script = require('./scripts/template-manager.js')
             await script({github, context, core});
+
+  ci:
+    name: ci
+    if: always() && github.event_name == 'pull_request'
+    needs: [test, preview-workflows]
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Require script tests and workflow preview
+        env:
+          TEST: ${{ needs.test.result }}
+          PREVIEW: ${{ needs.preview-workflows.result }}
+        run: test "$TEST" = success && test "$PREVIEW" = success

From ce61f54b64d3831b93d5f451dbf2f5f60453d0b1 Mon Sep 17 00:00:00 2001
From: Defang Agent <140542220+defangdevs@users.noreply.github.com>
Date: Fri, 13 Nov 2026 14:41:45 -0700
Subject: [PATCH 2/2] fix(ci): correctly filter paginated PR files

---
 .github/workflows/dependabot-automerge.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 05f99d3a..c5d97d7d 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -25,7 +25,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          safe=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100" --jq '[.[][] | select(.filename | startswith("samples/"))] | length == 0')
+          files=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files?per_page=100")
+          safe=$(jq '[.[][] | select(.filename | startswith("samples/"))] | length == 0' <<< "$files")
           echo "safe=$safe" >> "$GITHUB_OUTPUT"
 
       - name: Approve patch and minor updates