merge-dependabot.yml

name: "Dependabot: Merge actions updates in template repos"
on:
  # https://securitylab.github.com/research/github-actions-preventing-pwn-requests
  # could and should work, at least for public repos;
  # tracking issue for this action's issue:
  # https://github.com/ahmadnassri/action-dependabot-auto-merge/issues/60
  pull_request:
    types:
      - labeled
      - unlabeled
      - synchronize
      - opened
      - edited
      - ready_for_review
      - reopened
      - unlocked
  pull_request_review:
      types:
        - submitted
  check_suite:
      types:
        - completed
  status: { }

jobs:
  auto_merge_dependabot:
    if: |-
      endsWith(github.repository, '-template') &&
      startsWith(github.head_ref, 'dependabot/github_actions/')
    runs-on: [self-hosted, linux]

    permissions:
      contents: write
      pull-requests: write

    # Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly.

    steps:
      - name: "Initialise Workspace"
        shell: bash
        run: sudo chown -R "$USER:$USER" "$GITHUB_WORKSPACE"
      - name: "Check Owner"
        shell: bash
        run: echo "${{github.repository_owner}}"
      - name: "Auto-Merge"
        if: github.repository_owner == 'funfair-tech'
        uses: pascalgn/automerge-action@v0.15.6
        env:
          GITHUB_TOKEN: ${{secrets.SOURCE_PUSH_TOKEN}}
          MERGE_METHOD: merge
          MERGE_COMMIT_MESSAGE: pull-request-title-and-description
          MERGE_REQUIRED_APPROVALS: 1
          MERGE_DELETE_BRANCH: true
          MERGE_FORKS: false
          MERGE_LABELS: github-actions
          UPDATE_RETRIES: 10