dependabot-auto-merge.yml

name: Dependabot Auto-Merge

on:
  pull_request:
    branches:
      - main
    types: [opened, reopened, synchronize, ready_for_review]
  workflow_run:
    workflows:
      - Pull Request Validation
      - Python Quality
      - MegaLinter
    types:
      - completed

jobs:
  auto-merge-dependabot:
    name: Auto-merge Dependabot PRs
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_run'
    permissions:
      pull-requests: write
      contents: write
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    steps:
      - name: Resolve PR number
        id: pr
        run: |
          set -euo pipefail
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            echo "number=${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT"
          elif [ "${{ github.event_name }}" = "workflow_run" ] && [ "${{ github.event.workflow_run.pull_requests[0].number }}" != "" ]; then
            echo "number=${{ github.event.workflow_run.pull_requests[0].number }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Validate Dependabot author
        id: author
        if: steps.pr.outputs.number != ''
        run: |
          set -euo pipefail
          pr_number="${{ steps.pr.outputs.number }}"
          repo="${{ github.repository }}"

          author_login="$(gh pr view "$pr_number" --repo "$repo" --json author -q '.author.login')"
          echo "PR #$pr_number author: $author_login"

          if [ "$author_login" = "dependabot[bot]" ] || [ "$author_login" = "app/dependabot" ]; then
            echo "is_dependabot=true" >> "$GITHUB_OUTPUT"
          else
            echo "is_dependabot=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Enable auto-merge
        if: steps.pr.outputs.number != '' && steps.author.outputs.is_dependabot == 'true'
        run: |
          set -euo pipefail
          pr_number="${{ steps.pr.outputs.number }}"
          repo="${{ github.repository }}"

          echo "Enabling auto-merge for PR #$pr_number"

          if gh pr merge "$pr_number" --repo "$repo" --auto --merge --delete-branch; then
            echo "Configured with merge strategy"
          elif gh pr merge "$pr_number" --repo "$repo" --auto --squash --delete-branch; then
            echo "Configured with squash strategy"
          elif gh pr merge "$pr_number" --repo "$repo" --auto --rebase --delete-branch; then
            echo "Configured with rebase strategy"
          else
            echo "Failed to configure auto-merge for PR #$pr_number"
            exit 1
          fi

          merged_state="$(gh pr view "$pr_number" --repo "$repo" --json mergedAt -q '.mergedAt != null')"
          auto_state="$(gh pr view "$pr_number" --repo "$repo" --json autoMergeRequest -q '.autoMergeRequest != null')"

          if [ "$merged_state" = "true" ] || [ "$auto_state" = "true" ]; then
            echo "Auto-merge active (or already merged) for PR #$pr_number"
          else
            echo "Auto-merge was not enabled for PR #$pr_number"
            exit 1
          fi

      - name: Skip non-Dependabot PR
        if: steps.pr.outputs.number != '' && steps.author.outputs.is_dependabot != 'true'
        run: |
          pr_num="${{ steps.pr.outputs.number }}"
          echo "PR #$pr_num is not from Dependabot; skipping."