dependabot.yaml

name: Dependabot Auto-Merge

on:
  pull_request_target:
    branches:
      - main

permissions: {}

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    environment: release
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    steps:
      # The default GITHUB_TOKEN lacks the `workflows` scope and is refused on
      # PRs that touch .github/workflows; use the release app token instead.
      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
        id: app-token
        with:
          app-id: ${{ vars.RELEASE_APP_ID }}
          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write
          permission-workflows: write
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}
      # Only minor and patch GitHub Actions bumps auto-merge; majors and the
      # test suite submodule wait for a human review.
      - name: Auto-merge minor and patch GitHub Actions updates
        if: steps.metadata.outputs.package-ecosystem == 'github_actions' && steps.metadata.outputs.update-type != 'version-update:semver-major'
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: |
          gh pr review --approve "${PR_URL}"
          gh pr merge --auto --squash "${PR_URL}"