ci: group Dependabot example updates and verify only what changed

.github/dependabot.yml

@@ -0,0 +1,107 @@
+# Dependabot configuration for the example applications.
+#
+# The adapter itself (Cargo.toml at the repo root) is deliberately NOT managed here:
+# it ships as the lambda-adapter binary, and its dependencies are reviewed by hand.
+#
+# Why this file exists: without it, Dependabot opens one pull request per advisory
+# per manifest. That produced 69 open PRs, eight of them against the single lockfile
+# in examples/remix/remix-app, which then conflict with each other as soon as one
+# lands. The `groups` blocks below batch each ecosystem's security fixes so an
+# example app is updated by one PR instead of eight.
+#
+# Grouping is per directory: Dependabot treats each (ecosystem, directory) pair as its
+# own update and does not batch across directories unless `group-by: dependency-name`
+# is set, which applies to version updates only. So this yields one pull request per
+# example app per ecosystem, which is the intent — a broken bump then fails one
+# example's verification instead of blocking every example's fixes at once.
+#
+# `open-pull-requests-limit: 0` disables *version* updates and leaves *security*
+# updates on, which keeps the current behavior: Dependabot only opens PRs for
+# advisories, not for every dependency that drifts behind. Security updates are
+# explicitly exempt from this limit and do not count toward it. Raise it per ecosystem
+# if you later want routine version bumps too.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directories:
+      - "/examples/**"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore
+    groups:
+      examples-npm:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: pip
+    directories:
+      - "/examples/**"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore
+    groups:
+      examples-pip:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: gomod
+    directories:
+      - "/examples/**"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore
+    groups:
+      examples-gomod:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: maven
+    directories:
+      - "/examples/**"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore
+    groups:
+      examples-maven:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: nuget
+    directories:
+      - "/examples/**"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore
+    groups:
+      examples-nuget:
+        applies-to: security-updates
+        patterns:
+          - "*"
+
+  - package-ecosystem: cargo
+    directories:
+      - "/examples/**"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 0
+    commit-message:
+      prefix: chore
+    groups:
+      examples-cargo:
+        applies-to: security-updates
+        patterns:
+          - "*"

.github/example-matrix.json

@@ -0,0 +1,26 @@
+{
+  "image": [
+    { "name": "expressjs", "path": "/", "expect_body": "Hi there!" },
+    { "name": "fastapi", "path": "/", "expect_body": "message" },
+    { "name": "fastapi-background-tasks", "path": "/", "expect_body": "message" },
+    { "name": "fasthtml", "path": "/", "expect_body": "Hello World" },
+    { "name": "gin", "path": "/", "expect_body": "message" },
+    { "name": "nextjs", "path": "/", "expect_body": "Next.js Logo" },
+    { "name": "remix", "path": "/", "expect_body": "Welcome to" },
+    { "name": "springboot", "path": "/v1/", "expect_body": "Hello, world!" }
+  ],
+  "zip": [
+    { "name": "deno-zip", "path": "/", "expect_body": "success", "port": "8000" },
+    { "name": "expressjs-zip", "path": "/", "expect_body": "Hi there!", "port": "8000" },
+    { "name": "fastapi-zip", "path": "/", "expect_body": "message", "port": "8000" },
+    { "name": "fasthtml-zip", "path": "/", "expect_body": "Hello World", "port": "8000" },
+    { "name": "flask-zip", "path": "/", "expect_body": "message", "port": "8000" },
+    { "name": "gin-zip", "path": "/", "expect_body": "message", "port": "8000" },
+    { "name": "remix-zip", "path": "/", "expect_body": "Welcome to", "port": "8000" },
+    { "name": "springboot-zip", "path": "/v1/", "expect_body": "Hello, world!", "port": "8000" }
+  ],
+  "stream": [
+    { "name": "fasthtml-response-streaming", "kind": "image", "path": "/", "expect_body": "Serverless Bedtime" },
+    { "name": "fasthtml-response-streaming-zip", "kind": "zip-fasthtml", "path": "/", "expect_body": "Click to stream" }
+  ]
+}

.github/scripts/select-examples.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+#
+# Picks which examples the Verify Examples workflow needs to run, and writes one
+# matrix per job kind (image, zip, stream) to $GITHUB_OUTPUT.
+#
+# A dependency bump under examples/remix/remix-app has no bearing on springboot or
+# deno-zip, so verifying all 18 matrix entries for it burns runners for no signal.
+# With ~70 open Dependabot PRs against the examples that cost dominates CI.
+#
+# Fails safe: anything this script cannot resolve confidently — no base commit, a
+# base commit not present locally, a change to shared code — verifies everything.
+#
+# Inputs:
+#   BASE_SHA       base commit to diff against; empty means "verify everything"
+#   GITHUB_OUTPUT  set by Actions
+set -euo pipefail
+
+MATRIX="$(dirname "$0")/../example-matrix.json"
+
+emit_all() {
+  local kind
+  for kind in image zip stream; do
+    echo "$kind=$(jq -c ".$kind" "$MATRIX")" >>"$GITHUB_OUTPUT"
+  done
+}
+
+if [[ -z "${BASE_SHA:-}" ]]; then
+  echo "No base commit (push or manual run): verifying every example."
+  emit_all
+  exit 0
+fi
+
+if ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
+  echo "Base commit $BASE_SHA is not available locally: verifying every example."
+  emit_all
+  exit 0
+fi
+
+# HEAD is the pull request's merge commit, so diffing from the merge base yields
+# exactly the changes the PR contributes.
+base="$(git merge-base "$BASE_SHA" HEAD)"
+changed="$(git diff --name-only "$base" HEAD)"
+echo "Changed files:"
+echo "$changed" | sed 's/^/  /'
+
+# Shared inputs every example is built against: the adapter itself, the layer
+# wrapper, this workflow's own machinery.
+if grep -qE '^(src/|layer/|Cargo\.toml$|Cargo\.lock$|\.github/workflows/examples\.yaml$|\.github/scripts/|\.github/example-matrix\.json$)' <<<"$changed"; then
+  echo "A shared path changed: verifying every example."
+  emit_all
+  exit 0
+fi
+
+# examples/<name>/... -> <name>
+names="$(grep -oE '^examples/[^/]+' <<<"$changed" | cut -d/ -f2 | sort -u | jq -R . | jq -sc .)"
+echo "Changed examples: $names"
+
+for kind in image zip stream; do
+  matrix="$(jq -c --argjson names "$names" "[.$kind[] | select(.name as \$n | \$names | index(\$n))]" "$MATRIX")"
+  echo "$kind=$matrix"
+  echo "$kind=$matrix" >>"$GITHUB_OUTPUT"
+done

.github/workflows/dependabot-automerge.yaml

@@ -0,0 +1,78 @@
+name: Dependabot Auto-merge
+
+# Merges Dependabot pull requests that only touch example applications, once Verify
+# Examples has actually verified them.
+#
+# Why workflow_run rather than `gh pr merge --auto`: auto-merge is gated on a
+# repository's *required* status checks, and Verify Examples is path-filtered to
+# examples/**. A required check from a path-filtered workflow never reports on pull
+# requests outside those paths, which would block every source-only pull request
+# forever. Keying off the completed run sidesteps that: the run itself is the evidence,
+# and it is tied to the head commit that will be merged.
+#
+# Requires no branch protection and no repository settings.
+on:
+  workflow_run:
+    workflows: ["Verify Examples"]
+    types:
+      - completed
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  merge:
+    # Only a green pull request run can merge anything. A push run has no pull request
+    # to merge, and a failed run is the whole point of the gate.
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Merge if this is an example-only Dependabot update that was verified
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
+        run: |
+          set -euo pipefail
+
+          if [[ -z "${PR_NUMBER:-}" ]]; then
+            echo "Run is not associated with a pull request; nothing to merge."
+            exit 0
+          fi
+
+          author=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json author -q .author.login)
+          if [[ "$author" != "app/dependabot" && "$author" != "dependabot[bot]" ]]; then
+            echo "PR #$PR_NUMBER is authored by $author, not Dependabot. Skipping."
+            exit 0
+          fi
+
+          # Scope by what the PR actually changes rather than by its branch name:
+          # grouped updates do not reliably encode the directory in the ref. Examples
+          # are demo apps, so a bad bump costs a broken sample; the adapter's own
+          # dependencies, the workflows, and the templates stay manual.
+          outside=$(gh api --paginate "repos/$REPO/pulls/$PR_NUMBER/files" -q '.[].filename' \
+            | grep -v '^examples/' || true)
+          if [[ -n "$outside" ]]; then
+            echo "PR #$PR_NUMBER changes files outside examples/:"
+            echo "$outside" | sed 's/^/  /'
+            exit 0
+          fi
+
+          # Refuse to merge on template validation alone. If `select` filtered every
+          # matrix entry out, the changed example is not covered by a build-and-boot
+          # test, and a human should look at it. This is what keeps an uncovered
+          # example (nextjs-zip, say) from riding in on a green-but-empty run.
+          verified=$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs" --paginate \
+            -q '[.jobs[] | select(.name | startswith("test-")) | select(.conclusion == "success")] | length')
+          if [[ "$verified" -eq 0 ]]; then
+            echo "No test-* job ran for PR #$PR_NUMBER: the changed example has no"
+            echo "build-and-boot coverage, so this needs a human. Skipping."
+            exit 0
+          fi
+
+          echo "PR #$PR_NUMBER is example-only and passed $verified verification job(s). Merging."
+          gh pr merge "$PR_NUMBER" --repo "$REPO" --squash --delete-branch