dependabot-auto-merge.yml

name: Dependabot auto-merge

on: pull_request

permissions:
  contents: write
  pull-requests: write

jobs:
  dependabot:
    if: >-
      github.actor == 'dependabot[bot]' &&
      github.event.pull_request.user.login == 'dependabot[bot]' &&
      github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    steps:
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
        with:
          github-token: "${{ secrets.DEPENDABOT_APPROVAL_TOKEN }}"
          alert-lookup: true

      - name: Approve eligible Dependabot PR
        if: ${{ (steps.metadata.outputs.alert-state == 'OPEN' && !contains(steps.metadata.outputs.dependency-names, ',')) || contains(fromJson('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type) }}
        run: |
          gh api --method POST \
            "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/reviews" \
            -f event=APPROVE \
            -f commit_id="$HEAD_SHA" \
            -f body="Automated approval: verified Dependabot update; required checks remain authoritative."
        env:
          # This must be a Dependabot secret owned by a maintainers-team member.
          GH_TOKEN: ${{ secrets.DEPENDABOT_APPROVAL_TOKEN }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PR_NUMBER: ${{ github.event.pull_request.number }}

      - name: Enable auto-merge for Dependabot PRs
        if: ${{ (steps.metadata.outputs.alert-state == 'OPEN' && !contains(steps.metadata.outputs.dependency-names, ',')) || contains(fromJson('["version-update:semver-minor","version-update:semver-patch"]'), steps.metadata.outputs.update-type) }}
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}