dependabot-automerge.yml

name: Dependabot auto-merge

on:
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  actions: read
  contents: write
  pull-requests: write

jobs:
  automerge:
    name: Auto-merge safe dependency updates
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - name: Wait for frontend and backend CI
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: |
          set -euo pipefail
          sha="${{ github.event.pull_request.head.sha }}"

          for attempt in $(seq 1 60); do
            checks="$(gh api "repos/${{ github.repository }}/commits/${sha}/check-runs?per_page=100")"
            ci_checks="$(jq -c '[.check_runs[] | select(.app.slug == "github-actions" and (.name == "Frontend build" or .name == "Backend build"))] | sort_by(.name, .started_at) | group_by(.name) | map(.[-1])' <<<"$checks")"
            count="$(jq 'length' <<<"$ci_checks")"
            failed="$(jq '[.[] | select(.status == "completed" and .conclusion != "success")] | length' <<<"$ci_checks")"
            passed="$(jq '[.[] | select(.status == "completed" and .conclusion == "success")] | length' <<<"$ci_checks")"

            if [ "$failed" -gt 0 ]; then
              echo "Required CI failed"
              exit 1
            fi
            if [ "$count" -eq 2 ] && [ "$passed" -eq 2 ]; then
              exit 0
            fi
            sleep 10
          done

          echo "Timed out waiting for required CI"
          exit 1

      - name: Merge after CI passes
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: gh pr merge --squash --delete-branch "$PR_URL"