ci(deps): bump the github-actions group across 1 directory with 4 updates #14

	# © 2026 NetApp, Inc. All Rights Reserved.
	# SPDX-License-Identifier: Apache-2.0
	# See the NOTICE file in the repo root for trademark and attribution details.

	name: Dependabot auto-merge

	# Auto-approves and enables auto-merge for the lowest-risk Dependabot PRs
	# (github-actions patch/minor bumps) so they don't need a manual review
	# click. Everything else (major bumps, python/terraform runtime deps)
	# still goes through normal human review - this only fires on CI-only,
	# semver-safe updates, and still requires the existing required checks
	# (validate-and-lint, secret-scan, commitlint) to pass before GitHub will
	# actually merge it.
	on:
	pull_request_target:
	branches: [main]

	permissions:
	contents: write
	pull-requests: write

	jobs:
	auto-merge:
	if: github.actor == 'dependabot[bot]'
	runs-on: ubuntu-latest
	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
	with:
	egress-policy: audit

	- name: Fetch Dependabot metadata
	id: metadata
	uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
	with:
	github-token: "${{ secrets.GITHUB_TOKEN }}"

	- name: Approve and enable auto-merge
	if: \|
	steps.metadata.outputs.package-ecosystem == 'github-actions' &&
	steps.metadata.outputs.update-type != 'version-update:semver-major'
	env:
	PR_URL: ${{ github.event.pull_request.html_url }}
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	gh pr review --approve "$PR_URL"
	gh pr merge --auto --squash "$PR_URL"

Navigation Menu