chore: update dependabot configuration

.editorconfig

@@ -3,14 +3,16 @@ root = true
 [*]
 charset = utf-8
 end_of_line = lf
-insert_final_newline = true
-indent_style = space
 indent_size = 4
+indent_style = space
+insert_final_newline = true
 trim_trailing_whitespace = true
 
 [*.md]
 trim_trailing_whitespace = false
 
-[*.yml]
+[*.{yml,yaml}]
-indent_style = space
 indent_size = 2
+
+[docker-compose.yml]
+indent_size = 4

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore

.github/dependabot.yml

@@ -8,6 +8,7 @@ updates:
     open-pull-requests-limit: 10
     groups:
       actions:
+        applies-to: version-updates
         patterns: ["*"]
     commit-message:
       prefix: "chore"
@@ -23,9 +24,13 @@ updates:
     open-pull-requests-limit: 10
     groups:
       php-minor-patch:
+        applies-to: version-updates
         update-types:
           - "minor"
           - "patch"
+      php-security:
+        applies-to: security-updates
+        patterns: ["*"]
     commit-message:
       prefix: "chore"
       include: "scope"

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,59 @@
+name: Dependabot Auto-merge
+
+on:
+  workflow_run:
+    workflows: ["Tests"]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
+
+    steps:
+      - name: Find PR and check update type
+        id: check
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          PR_DATA=$(gh pr list --repo "${{ github.repository }}" --head "$HEAD_BRANCH" --json number,title,url,author --jq '.[0]')
+
+          PR_URL=$(echo "$PR_DATA" | jq -r '.url')
+          PR_AUTHOR=$(echo "$PR_DATA" | jq -r '.author.login')
+          PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+
+          echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
+
+          if [ "$PR_AUTHOR" != "app/dependabot" ]; then
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Not a Dependabot PR, skipping."
+            exit 0
+          fi
+
+          # Parse major version numbers from title: "bump X from A[.B.C] to D[.E.F]"
+          # Works for both "from 4.0.0 to 4.1.0" and "from 4 to 6" (GitHub Actions)
+          FROM_MAJOR=$(echo "$PR_TITLE" | grep -oP 'from \K[0-9]+')
+          TO_MAJOR=$(echo "$PR_TITLE" | grep -oP 'to \K[0-9]+')
+
+          echo "PR: $PR_TITLE (major: $FROM_MAJOR -> $TO_MAJOR)"
+
+          if [ "$FROM_MAJOR" = "$TO_MAJOR" ]; then
+            echo "is_safe=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Major version bump, skipping auto-merge."
+          fi
+
+      - name: Merge minor and patch updates
+        if: steps.check.outputs.is_safe == 'true'
+        run: gh pr merge --merge "${{ steps.check.outputs.pr_url }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dependabot-slack-alert.yml

@@ -0,0 +1,98 @@
+name: Dependabot Slack Alert
+
+on:
+  pull_request_target:
+    types: [opened]
+
+jobs:
+  notify:
+    name: Notify Slack of major update
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Check if major version bump
+        id: check
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          from_major=$(echo "$PR_TITLE" | grep -oP 'from \K[0-9]+' | head -1)
+          to_major=$(echo "$PR_TITLE" | grep -oP 'to \K[0-9]+' | head -1)
+
+          if [ -n "$from_major" ] && [ -n "$to_major" ] && [ "$from_major" != "$to_major" ]; then
+            echo "is_major=true" >> $GITHUB_OUTPUT
+            echo "Major bump detected: $from_major -> $to_major"
+          else
+            echo "is_major=false" >> $GITHUB_OUTPUT
+            echo "Minor/patch bump, skipping"
+          fi
+
+      - name: Send Slack alert
+        if: steps.check.outputs.is_major == 'true'
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          if [ -z "$SLACK_WEBHOOK_URL" ]; then
+            echo "SLACK_WEBHOOK_URL not configured for this repo, skipping"
+            exit 0
+          fi
+
+          payload=$(jq -n \
+            --arg repo "$REPO" \
+            --arg title "$PR_TITLE" \
+            --arg url "$PR_URL" \
+            --arg pr "#$PR_NUMBER" \
+            '{
+              blocks: [
+                {
+                  type: "section",
+                  text: {
+                    type: "mrkdwn",
+                    text: ":dependabot: *Major dependency update requires review*"
+                  }
+                },
+                {
+                  type: "section",
+                  fields: [
+                    {type: "mrkdwn", text: ("*Repository*\n`" + $repo + "`")},
+                    {type: "mrkdwn", text: ("*Pull Request*\n<" + $url + "|" + $pr + ">") }
+                  ]
+                },
+                {
+                  type: "section",
+                  text: {
+                    type: "mrkdwn",
+                    text: $title
+                  }
+                },
+                {
+                  type: "context",
+                  elements: [
+                    {
+                      type: "mrkdwn",
+                      text: "Major version bumps are not auto-merged as they may contain breaking changes."
+                    }
+                  ]
+                },
+                {
+                  type: "actions",
+                  elements: [
+                    {
+                      type: "button",
+                      text: {type: "plain_text", text: "Review PR"},
+                      url: $url,
+                      style: "primary"
+                    }
+                  ]
+                }
+              ]
+            }')
+
+          curl -s -o /dev/null -w "%{http_code}" -X POST "$SLACK_WEBHOOK_URL" \
+            -H "Content-type: application/json" \
+            --data "$payload" | grep -q "^200$" \
+            && echo "Slack notification sent" \
+            || echo "Slack notification failed"

pint.json

@@ -1,6 +1,13 @@
 {
     "preset": "laravel",
     "rules": {
-        "no_superfluous_phpdoc_tags": true
+        "concat_space": {
+            "spacing": "one"
+        },
+        "class_attributes_separation": false,
+        "ordered_imports": {
+            "sort_algorithm": "length"
+        },
+        "not_operator_with_space": false
     }
 }