dependabot-automerge.yaml

# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enable-auto-merge-on-a-pull-request
name: dependabot auto-merge
on:
  pull_request:
    branches:
    - main
permissions: {}
jobs:
  dependabot-automerge:
    permissions:
      contents: write
      pull-requests: write
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
    - name: Fetch dependabot metadata
      id: metadata
      uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
      with:
        github-token: "${{ secrets.GITHUB_TOKEN }}"
    - name: Auto-merge Dependabot PRs
      # don't auto-merge action updates to appease OpenSSF scorecard
      if: ${{ ! contains(steps.metadata.outputs.package-ecosystem, 'github-actions') }}
      run: gh pr merge --auto --merge "$PR_URL"
      env:
        PR_URL: ${{github.event.pull_request.html_url}}
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
    - name: Auto-approve Github maintained actions
      if: contains(steps.metadata.outputs.dependency-names, 'github/codeql-action')
      run: gh pr review --approve "$PR_URL"
      env:
        PR_URL: ${{github.event.pull_request.html_url}}
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}