approve-dependabot.yml

name: "Dependabot: Approve actions updates in template repos"
on:
  # https://securitylab.github.com/research/github-actions-preventing-pwn-requests
  # could and should work, at least for public repos;
  # tracking issue for this action's issue:
  # https://github.com/ahmadnassri/action-dependabot-auto-merge/issues/60
  pull_request_target:
    types:
    - opened
    - edited
    - reopened
    - synchronize
    - ready_for_review
    branches:
    - main

jobs:
  enable-auto-merge:
    if: |-
      endsWith(github.repository, '-template') &&
      startsWith(github.head_ref, 'dependabot/github_actions/')
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write

    # Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly.

    steps:
    - name: "Initialise Workspace"
      shell: bash
      run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
    - name: "Check Repo Owner"
      uses: actions/github-script@v7.0.1
      with:
        script: |
          core.info('Owner: ${{github.repository_owner}}');
    - name: "Auto Merge"
      uses: alexwilson/enable-github-automerge-action@1.0.0
      with:
        github-token: ${{secrets.SOURCE_PUSH_TOKEN}}
        merge-method: "MERGE"

  auto_approve_dependabot:
    if: |-
      endsWith(github.repository, '-template') &&
      startsWith(github.head_ref, 'dependabot/github_actions/')
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write

    steps:
    - name: "Initialise Workspace"
      shell: bash
      run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
    - name: "Check Repo Owner"
      uses: actions/github-script@v7.0.1
      with:
        script: |
          core.info('Owner: ${{github.repository_owner}}');
    - name: "Approve"
      uses: hmarr/auto-approve-action@v3
      with:
        github-token: ${{secrets.SOURCE_PUSH_TOKEN}}