dependabot-auto-merge.yml•2.36 kB
name: Dependabot Auto-Merge
on:
pull_request:
types: [opened, synchronize, reopened]
permissions:
contents: write
pull-requests: write
jobs:
auto-merge:
runs-on: ubuntu-latest
if: github.event.pull_request.user.login == 'dependabot[bot]'
steps:
- name: Get Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@v2
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
- name: Debug metadata
run: |
echo "Update type: ${{ steps.metadata.outputs.update-type }}"
echo "Dependency type: ${{ steps.metadata.outputs.dependency-type }}"
echo "Package ecosystem: ${{ steps.metadata.outputs.package-ecosystem }}"
echo "Dependency name: ${{ steps.metadata.outputs.dependency-names }}"
- name: Auto-approve and enable auto-merge for safe updates
if: |
(steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
steps.metadata.outputs.update-type == 'version-update:semver-minor') &&
(steps.metadata.outputs.dependency-type == 'direct:development' ||
steps.metadata.outputs.package-ecosystem == 'github_actions')
run: |
gh pr review "$PR_URL" --approve --body "Auto-approved: patch/minor update to dev dependency"
gh pr merge "$PR_URL" --auto --squash
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on major updates
if: |
steps.metadata.outputs.update-type == 'version-update:semver-major'
run: |
gh pr comment "$PR_URL" --body "⚠️ **Major version update** - requires manual review before merging."
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on production dependency updates
if: |
steps.metadata.outputs.dependency-type == 'direct:production' &&
steps.metadata.outputs.update-type != 'version-update:semver-major'
run: |
gh pr comment "$PR_URL" --body "📦 **Production dependency update** - please review and merge manually if tests pass."
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}