dependabot-enable-auto-merge.yml

# Copyright 2023 Google LLC 

 # 

 # Licensed under the Apache License, Version 2.0 (the "License"); 

 # you may not use this file except in compliance with the License. 

 # You may obtain a copy of the License at 

 # 

 #     http://www.apache.org/licenses/LICENSE-2.0 

 # 

 # Unless required by applicable law or agreed to in writing, software 

 # distributed under the License is distributed on an "AS IS" BASIS, 

 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 

 # See the License for the specific language governing permissions and 

 # limitations under the License. 

  

 name: Enable Dependabot auto-merge 

 # This does not merge the PR's, it just enabled auto-merge 

 # They still need to be approved. 

 # Saves some time when going through the dependabot PRs. 

 on: pull_request 

  

 permissions: 

   contents: write 

   pull-requests: write 

  

 jobs: 

   dependabot: 

     runs-on: ubuntu-latest 

     if: ${{ github.actor == 'dependabot[bot]' }} 

     steps: 

       - name: Harden Runner 

         uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1 

         with: 

           egress-policy: audit 

  

       - name: Dependabot metadata 

         id: metadata 

         uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0 

         with: 

           github-token: "${{ secrets.GITHUB_TOKEN }}" 

       - name: Enable auto-merge for Dependabot PRs 

         run: gh pr merge --auto --squash "$PR_URL" 

         env: 

           PR_URL: ${{github.event.pull_request.html_url}} 

           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}