automerge.yml

name: Dependabot auto-merge

# Hardened against the CVE-2025-61671 pattern (and similar):
#   * Trust the PR author via `github.event.pull_request.user.login` only as a
#     coarse gate. The actual security boundary is the official
#     dependabot/fetch-metadata action, which signs over the PR contents and
#     exposes update-type / dependency metadata in a tamper-resistant way.
#   * Only `version-update:semver-patch`, `version-update:semver-security`,
#     and indirect (lockfile-resolution) bumps are eligible for `--merge` —
#     indirect updates carry no update-type metadata but stay within the
#     constraints declared in the manifest. Direct minor and major bumps get
#     `--approve` only; a human must hit the merge button.
#   * `gh pr merge --auto --squash` lets GitHub gate the actual merge on the
#     repository's required status checks (configured via branch protection),
#     so we do NOT need to wait for CI inside this workflow.
#   * The merge step authenticates with AUTOMERGE_PAT (not GITHUB_TOKEN):
#     pushes made with GITHUB_TOKEN do not trigger workflows, so the merged
#     commit would never get a CI build or deploy.

'on':
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions:
  contents: write
  pull-requests: write

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  automerge:
    runs-on: ubuntu-latest
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    steps:
      - name: Fetch Dependabot metadata
        id: meta
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98  # v3.1.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Approve PR (all update types)
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh pr review --approve "$PR_URL"

      - name: Enable auto-merge (patch, security, indirect)
        if: |
          steps.meta.outputs.update-type == 'version-update:semver-patch' ||
          steps.meta.outputs.update-type == 'version-update:semver-security' ||
          steps.meta.outputs.dependency-type == 'indirect'
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.AUTOMERGE_PAT }}
        run: gh pr merge --auto --squash "$PR_URL"