name: Dependabot auto-merge
on: pull_request

permissions: {}

jobs:
  dependabot:
    permissions:
      contents: write
      pull-requests: write
      checks: read
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Confirm required checks are configured
        if: >
          steps.metadata.outputs.package-ecosystem == 'github_actions' &&
          contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
        run: |
          REQUIRED=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${{ github.event.pull_request.base.ref }}/protection/required_status_checks" --jq '((.contexts // []) | length) + ((.checks // []) | length)' 2>/dev/null || echo 0)
          if [ "$REQUIRED" -eq 0 ]; then
            echo "No required status checks configured on the base branch; refusing Dependabot auto-merge."
            exit 1
          fi
        env:
          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

      - name: Approve low-risk Dependabot PR
        if: >
          steps.metadata.outputs.package-ecosystem == 'github_actions' &&
          contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

      - name: Enable auto-merge for low-risk Dependabot PRs
        if: >
          steps.metadata.outputs.package-ecosystem == 'github_actions' &&
          contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
        run: gh pr merge --auto --merge "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}