dependabot-approve-and-auto-merge.yml

name: Dependabot Pull Request Approve and Merge
on: pull_request #_target
permissions:
  pull-requests: write
  contents: write
jobs:
  pull-request-title-change:
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      # Checkout the source code
      - name: 'Checkout source code'
        uses: actions/checkout@v4

      - name: 'Fetch Dependabot metadata'
        id: dependabot-fetch
        uses: dependabot/fetch-metadata@v2

      - name: 'Split title and update'
        id: split-title
        if: ${{ ! contains(github.event.pull_request.title, '):' ) && contains(github.event.pull_request.title, ':')  && steps.dependabot-fetch.outcome == 'success' }}
        env:
          TITLE: ${{ github.event.pull_request.title }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_URL: ${{github.event.pull_request.html_url}}
        run: |
          title_pt2="${TITLE##*:}"
          title_pt1="${TITLE%%:*}"
          gh pr checkout "$PR_URL" # sets the upstream metadata for `gh pr status`
          packagename="${{ steps.dependabot-fetch.outputs.dependency-names }}"
          parensOpen="("
          parensClose="):"
          pr_title=$title_pt1$parensOpen$packagename$parensClose$title_pt2
          gh pr edit "$PR_URL" --title "$pr_title"

  # Auto merge Dependabot PRs for:
  # - patch updates on prod dependencies
  # - minor updates on dev dependencies
  dependabot-auto-merge:
    needs: pull-request-title-change
    # Only run for Dependabot PRs
    if: ${{ github.actor == 'dependabot[bot]' }}
    runs-on: ubuntu-latest
    steps:
      - name: 'Fetch Dependabot metadata'
        id: dependabot
        uses: dependabot/fetch-metadata@v2

      - name: 'Check auto merge conditions'
        id: auto-merge
        if: |
          (
            steps.dependabot.outputs.update-type == 'version-update:semver-patch' &&
            contains('direct:production,indirect:production', steps.dependabot.outputs.dependency-type)
          ) || (
            contains('version-update:semver-minor,version-update:semver-patch', steps.dependabot.outputs.update-type) &&
            contains('direct:development,indirect:development', steps.dependabot.outputs.dependency-type)
          )
        run: echo "::notice ::auto-merge conditions satisfied"

      - name: 'Approve and merge PR'
        if: ${{ steps.auto-merge.conclusion == 'success' }}
        run: |
          gh pr review --approve "$PR_URL"
          gh pr merge --auto --squash "$PR_URL"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_URL: ${{ github.event.pull_request.html_url }}