dependabot.yml

name: Dependabot Approve and Merge

on:
  workflow_call:

    secrets:
      pr_approve_and_merge_pem:
        description: The GitHub App PEM file
        required: true

permissions: {}

jobs:
  dependabot:
    name: Pull request approve and merge
    if: ${{ github.actor == 'dependabot[bot]' }}
    runs-on: ubuntu-latest

    steps:
      # Create GitHub App Token
      # https://github.com/actions/create-github-app-token

      - name: Create GitHub App Token
        uses: actions/create-github-app-token@v1.11.5
        id: app-token
        with:
          app-id: 1080767
          private-key: ${{ secrets.pr_approve_and_merge_pem }}

      # Fetch Metadata from Dependabot PRs
      # https://github.com/marketplace/actions/fetch-metadata-from-dependabot-prs

      - name: Dependabot metadata
        id: dependabot-metadata
        uses: dependabot/fetch-metadata@v2.3.0
        with:
          github-token: ${{ steps.app-token.outputs.token }}

      # GitHub command line
      # https://cli.github.com

      - name: Pull request approve
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

      - name: Pull request merge
        if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }}
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}