dependabot.yml

name: Dependabot

on:
  workflow_call:

    secrets:
      pr_approve_and_merge_pat:
        description: Branch protection with CODEOWNERS require use of a PAT with write access to the repo to approve and merge PRs
        required: true

permissions: {}

jobs:
  dependabot:
    name: Pull request approve and merge
    if: ${{ github.actor == 'dependabot[bot]' }}
    runs-on: ubuntu-latest

    steps:
      # Fetch Metadata from Dependabot PRs
      # https://github.com/marketplace/actions/fetch-metadata-from-dependabot-prs

      - name: Dependabot metadata
        id: dependabot-metadata
        uses: dependabot/fetch-metadata@v1.6.0
        with:
          github-token: "${{ secrets.pr_approve_and_merge_pat }}"

      # GitHub command line
      # https://cli.github.com

      - name: Pull request approve
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: "${{ secrets.pr_approve_and_merge_pat }}"

      - name: Pull request merge
        if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }}
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: "${{ secrets.pr_approve_and_merge_pat }}"