name: Dependabot auto-merge
on: pull_request

permissions: {}

jobs:
  dependabot:
    permissions:
      contents: write
      pull-requests: write
      checks: read
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Enable auto-merge for low-risk Dependabot PRs
        if: >
          steps.metadata.outputs.package-ecosystem == 'github_actions' &&
          contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
        run: gh pr merge --auto --merge "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}