Automatically update Dependabot pull requests (#3064)

This updates the "update PR" workflow to trigger for Dependabot PRs
automatically.

Author: Mrtenz

.github/workflows/main.yml

@@ -20,6 +20,16 @@ jobs:
         run: ${{ steps.download-actionlint.outputs.executable }} -color
         shell: bash
 
+  update-pull-request:
+    name: Update pull request
+    needs: check-workflows
+    if: ${{ github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' }}
+    uses: ./.github/workflows/update-pull-request.yml
+    with:
+      dependabot: true
+    secrets:
+      PULL_REQUEST_UPDATE_TOKEN: ${{ secrets.PULL_REQUEST_UPDATE_TOKEN }}
+
   lint-build-test:
     name: Build, lint, and test
     needs: check-workflows

.github/workflows/update-pull-request.yml

@@ -4,6 +4,15 @@ on:
   issue_comment:
     types:
       - created
+  workflow_call:
+    secrets:
+      PULL_REQUEST_UPDATE_TOKEN:
+        required: true
+    inputs:
+      dependabot:
+        type: boolean
+        required: false
+        default: false
 
 jobs:
   is-fork-pull-request:
@@ -24,9 +33,10 @@ jobs:
   react-to-comment:
     name: React to the comment
     runs-on: ubuntu-latest
-    needs: is-fork-pull-request
+    needs:
+      - is-fork-pull-request
     # Early exit if this is a fork, since later steps are skipped for forks.
-    if: ${{ needs.is-fork-pull-request.outputs.IS_FORK == 'false' }}
+    if: ${{ needs.is-fork-pull-request.outputs.IS_FORK == 'false' && inputs.dependabot == false }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -46,7 +56,8 @@ jobs:
   prepare:
     name: Prepare dependencies
     runs-on: ubuntu-latest
-    needs: is-fork-pull-request
+    needs:
+      - is-fork-pull-request
     # Early exit if this is a fork, since later steps are skipped for forks.
     if: ${{ needs.is-fork-pull-request.outputs.IS_FORK == 'false' }}
     outputs:
@@ -203,10 +214,13 @@ jobs:
           path: yarn.lock
           key: cache-yarn-lock-${{ needs.prepare.outputs.COMMIT_SHA }}
           fail-on-cache-miss: true
+      - name: Set commit prefix
+        if: ${{ inputs.dependabot == true }}
+        run: echo "COMMIT_PREFIX='[dependabot skip] '" >> "$GITHUB_ENV"
       - name: Commit yarn.lock
         run: |
           git add yarn.lock
-          git commit -m "Deduplicate yarn.lock" || true
+          git commit -m "${COMMIT_PREFIX}Deduplicate yarn.lock" || true
       - name: Restore LavaMoat policies
         uses: actions/cache/restore@v4
         with:
@@ -216,7 +230,7 @@ jobs:
       - name: Commit LavaMoat policies
         run: |
           git add packages/snaps-execution-environments/lavamoat
-          git commit -m "Update LavaMoat policies" || true
+          git commit -m "${COMMIT_PREFIX}Update LavaMoat policies" || true
       - name: Restore examples
         uses: actions/cache/restore@v4
         with:
@@ -226,6 +240,6 @@ jobs:
       - name: Commit examples
         run: |
           git add packages/examples/packages
-          git commit -m "Update example snaps" || true
+          git commit -m "${COMMIT_PREFIX}Update example snaps" || true
       - name: Push changes
         run: git push