dependabot-auto.yml

name: Dependabot Automation
on: pull_request_target

permissions:
  contents: write
  pull-requests: write
  issues: write
  repository-projects: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v1
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Project metadata
        uses: radcortez/project-metadata-action@ccd8f8f7fb37e8b19965d82fb9cea6e555b785b7
        id: projmeta
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          metadata-file-path: '.github/project.yml'
          local-file: 'true'

      - name: Determine milestone
        id: milestone
        uses: actions/github-script@v7
        env:
          VERSION: "${{ steps.projmeta.outputs.next-version }}"
        with:
          script: |
            const nextVersion = process.env.VERSION;
            core.setOutput('next-version', nextVersion.replace("-SNAPSHOT", ""));

      - name: Set PR milestone
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh pr edit "$PR_URL" --milestone "${{ steps.milestone.outputs.next-version }}"

      - name: Approve PR
        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh pr review --approve "$PR_URL"

      - name: Merge PR
        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.DEPENDENCY_TOKEN }}
        run: gh pr merge "$PR_URL" --auto --squash