Dependabot bumps of a direct production dependency of `e2b`, `@e2b/cli`
or `@e2b/python-sdk` need a changeset to reach users, and they kept
merging without one (#1461, #1443). This workflow commits a `patch`
changeset naming every released package the bump touches, and stays out
of the way otherwise — dev-only bumps, transitive-only lockfile bumps,
and pull requests that already carry a hand-written changeset are all
skipped. The push uses the version-bumper App token rather than
`GITHUB_TOKEN`, whose commits do not start workflow runs, so the
required checks would never report on the new head commit and the pull
request would be unmergeable.
For #1461 it would have committed `.changeset/dependabot-1461.md`:
```md
---
'e2b': patch
---
Update the `undici` dependency to 7.28.0.
```
The `changes` job now skips the Dependabot metadata lookup once a
changeset is on the branch, so the workflow's own commit never sends
`fetch-metadata` looking for metadata on a pull request that is no
longer all-Dependabot commits, and `dorny/paths-filter` is SHA-pinned as
the one third-party action this trigger reaches.
Verified by running the commit step against a scratch repository with
the exact expression outputs for single-package, grouped multi-package
and Python-only bumps, then parsing each result with changesets' own
`@changesets/parse`. Two things to watch on the first live run: the
org-level `verification/cla-signed` check has to accept the App's
commit, and adding a commit stops Dependabot auto-rebasing the branch
(`@dependabot rebase` still works, and the workflow rewrites the
changeset afterwards).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
SDK-311
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Mish Ushakov
9c555a12aa