Add comprehensive workflow automation for security, maintainer efficiency, and code quality

.github/dependabot.yml

@@ -0,0 +1,92 @@
+# Dependabot configuration for automated dependency updates
+# This helps keep dependencies secure and up-to-date
+version: 2
+updates:
+  # Enable version updates for Go modules
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "go"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Enable version updates for npm (web directory)
+  - package-ecosystem: "npm"
+    directory: "/web"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "javascript"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Enable version updates for npm (docs directory)
+  - package-ecosystem: "npm"
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "javascript"
+      - "documentation"
+    commit-message:
+      prefix: "chore(deps)"
+
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(deps)"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  # Enable version updates for Docker
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "chore(deps)"

.github/release-drafter.yml

@@ -0,0 +1,81 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+
+categories:
+  - title: '🚀 Features'
+    labels:
+      - 'kind/feature'
+      - 'enhancement'
+      - 'kind/enhancement'
+  - title: '🐛 Bug Fixes'
+    labels:
+      - 'kind/bug'
+      - 'bug'
+      - 'fix'
+  - title: '📚 Documentation'
+    labels:
+      - 'documentation'
+      - 'docs'
+  - title: '🔒 Security'
+    labels:
+      - 'security'
+  - title: '⚡ Performance'
+    labels:
+      - 'performance'
+  - title: '🧹 Maintenance'
+    labels:
+      - 'chore'
+      - 'dependencies'
+      - 'refactor'
+
+change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-title-escapes: '\<*_&'
+
+version-resolver:
+  major:
+    labels:
+      - 'major'
+      - 'breaking'
+  minor:
+    labels:
+      - 'minor'
+      - 'kind/feature'
+  patch:
+    labels:
+      - 'patch'
+      - 'kind/bug'
+  default: patch
+
+exclude-labels:
+  - 'skip-changelog'
+  - 'not-auto-close'
+
+autolabeler:
+  - label: 'documentation'
+    files:
+      - '*.md'
+      - 'docs/**/*'
+  - label: 'kind/bug'
+    branch:
+      - '/fix\/.+/'
+    title:
+      - '/fix/i'
+  - label: 'kind/feature'
+    branch:
+      - '/feat(ure)?\/.+/'
+    title:
+      - '/feat(ure)?/i'
+  - label: 'dependencies'
+    files:
+      - 'go.mod'
+      - 'go.sum'
+      - 'package.json'
+      - 'package-lock.json'
+      - 'yarn.lock'
+
+template: |
+  ## What's Changed
+
+  $CHANGES
+
+  **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION

.github/workflows/auto-assign-reviewers.yaml

@@ -0,0 +1,89 @@
+name: auto-assign-reviewers
+
+on:
+  pull_request:
+    types: [opened, ready_for_review]
+    branches:
+      - master
+      - 'release-v*'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  assign-reviewers:
+    runs-on: ubuntu-24.04
+    if: github.event.pull_request.draft == false
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Auto-assign reviewers based on changed files
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+
+            // Get changed files
+            const { data: files } = await github.rest.pulls.listFiles({
+              owner,
+              repo,
+              pull_number: prNumber
+            });
+
+            const reviewers = new Set();
+            const teamReviewers = new Set();
+
+            // Analyze changed files and assign appropriate reviewers
+            const hasGoChanges = files.some(f => f.filename.endsWith('.go'));
+            const hasWebChanges = files.some(f => f.filename.startsWith('web/'));
+            const hasWorkflowChanges = files.some(f => f.filename.startsWith('.github/workflows/'));
+            const hasDocChanges = files.some(f => f.filename.endsWith('.md'));
+            const hasManifestChanges = files.some(f => f.filename.startsWith('manifests/'));
+
+            // Add team reviewers based on changes
+            if (hasWebChanges) {
+              teamReviewers.add('pipecd-approvers-web');
+            }
+
+            // Always add general approvers for significant changes
+            if (hasGoChanges || hasWorkflowChanges || hasManifestChanges) {
+              teamReviewers.add('pipecd-approvers');
+            }
+
+            // Assign reviewers if any were identified
+            if (teamReviewers.size > 0) {
+              try {
+                await github.rest.pulls.requestReviewers({
+                  owner,
+                  repo,
+                  pull_number: prNumber,
+                  team_reviewers: Array.from(teamReviewers)
+                });
+
+                console.log(`Assigned team reviewers: ${Array.from(teamReviewers).join(', ')}`);
+              } catch (error) {
+                console.log('Could not assign team reviewers:', error.message);
+              }
+            }
+
+            // Add helpful labels
+            const labels = [];
+            if (hasGoChanges) labels.push('area/go');
+            if (hasWebChanges) labels.push('area/web');
+            if (hasWorkflowChanges) labels.push('area/build');
+            if (hasDocChanges) labels.push('kind/documentation');
+            if (hasManifestChanges) labels.push('area/manifests');
+
+            if (labels.length > 0) {
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
+                issue_number: prNumber,
+                labels
+              });
+
+              console.log(`Added labels: ${labels.join(', ')}`);
+            }

.github/workflows/auto-merge-dependabot.yaml

@@ -0,0 +1,64 @@
+name: auto-merge-dependabot
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge-dependabot:
+    runs-on: ubuntu-24.04
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Auto-approve minor and patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: |
+          gh pr review --approve "${{ github.event.pull_request.html_url }}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for safe updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: |
+          gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on major updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+
+            const comment = `## ⚠️ Major Version Update Detected
+
+This Dependabot PR contains a **major version update** for:
+- **${context.payload.pull_request.title}**
+
+**Action required:**
+- Manual review needed for breaking changes
+- Check changelog and migration guides
+- Update code if necessary
+- Run full test suite before merging
+
+**Update type:** \`${process.env.UPDATE_TYPE}\``;
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: comment
+            });
+        env:
+          UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}