Refactor Dependabot alert workflow to create issues for pull requests and automate merging. Enhanced issue creation with detailed metadata and improved duplicate detection.

Author: Dopeamin

.github/workflows/dependabot_alert_issues.yml

@@ -1,71 +1,138 @@
 name: Dependabot high/critical alert issues
 
 on:
-  dependabot_alert:
-    types: [created]
+  pull_request:
+    types: [opened, reopened, synchronize]
 
 permissions:
   issues: write
-  security-events: read
-  contents: read
+  contents: write # was: read  -> needed for merging
+  pull-requests: write # was: read  -> needed for merging
+  checks: read
+  statuses: read
 
 jobs:
   create_issue_for_high_critical:
     runs-on: ubuntu-latest
-    if: |
-      github.event.alert.severity == 'high' ||
-      github.event.alert.severity == 'critical'
+
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
 
     steps:
-      - name: Create tracking issue for alert
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create tracking issue for advisory
         uses: actions/github-script@v7
+        env:
+          GHSA: ${{ steps.metadata.outputs.ghsa-id }}
+          PACKAGE: ${{ steps.metadata.outputs.dependency-names }}
+          PREVIOUS_VERSION: ${{ steps.metadata.outputs.previous-version }}
+          NEW_VERSION: ${{ steps.metadata.outputs.new-version }}
+          UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
+          DEPENDENCY_TYPE: ${{ steps.metadata.outputs.dependency-type }}
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             const { owner, repo } = context.repo;
-            const alert = context.payload.alert;
-
-            const severity = (alert.severity || 'unknown').toUpperCase();
-            const pkg = alert.affected_package_name ||
-              (alert.package && alert.package.name) ||
-              'unknown-package';
-            const ghsa = alert.ghsa_id || 
-              alert.external_identifier || 
-              'unknown-GHSA';
-            const alertUrl = alert.html_url || 
-              alert.url || 
-              '(no URL provided)';
+            const pr = context.payload.pull_request;
+
+            const pkg = process.env.PACKAGE || 'unknown-package';
+            const ghsa = process.env.GHSA || '';
+            const previousVersion = process.env.PREVIOUS_VERSION || 'unknown';
+            const newVersion = process.env.NEW_VERSION || 'unknown';
+            const updateType = process.env.UPDATE_TYPE || 'unknown';
+            const dependencyType = process.env.DEPENDENCY_TYPE || 'unknown';
+            const alertUrl = pr.html_url; // link to PR as the "alert" surface
 
             const teamMention = '@Dopeamin';
 
-            const title = `[Dependabot] ${severity} vulnerability in ${pkg} (${ghsa})`;
+            const title = ghsa
+              ? `[Dependabot] Advisory for ${pkg} (${ghsa})`
+              : `[Dependabot] Update for ${pkg} (${previousVersion} → ${newVersion})`;
 
-            // Avoid duplicates: search by GHSA id in title
+            // Avoid duplicates: search by GHSA id or package/version in title
+            const duplicateQuery = ghsa
+              ? `repo:${owner}/${repo} "${ghsa}" in:title is:issue`
+              : `repo:${owner}/${repo} "${pkg}" "${newVersion}" in:title is:issue`;
             const search = await github.rest.search.issuesAndPullRequests({
-              q: `repo:${owner}/${repo} "${ghsa}" in:title is:issue`,
+              q: duplicateQuery,
             });
 
             if (search.data.total_count > 0) {
-              console.log('Issue already exists for this alert, skipping.');
+              console.log('Issue already exists for this advisory, skipping.');
               return;
             }
 
+            const details = [
+              `- **Package**: \`${pkg}\``,
+              `- **Update**: \`${previousVersion}\` → \`${newVersion}\``,
+              `- **Update type**: ${updateType}`,
+              `- **Dependency type**: ${dependencyType}`,
+              `- **PR**: #${pr.number}`,
+            ];
+
+            if (ghsa) {
+              details.splice(2, 0, `- **Advisory (GHSA)**: \`${ghsa}\``);
+            }
+
             const body = `${teamMention}
 
-            A new **${severity}** Dependabot alert was detected.
+            A new Dependabot pull request requires attention.
 
-            - **Package**: \`${pkg}\`
-            - **Advisory (GHSA)**: \`${ghsa}\`
-            - **Alert URL**: ${alertUrl}
+            ${details.join('\n')}
 
             This issue was created automatically by a GitHub Actions workflow.`;
 
+            const labels = ['dependabot'];
+            if (ghsa) {
+              labels.push('security');
+            }
             await github.rest.issues.create({
               owner,
               repo,
               title,
               body,
-              labels: ['security', 'dependabot', severity.toLowerCase()],
-              
+              labels,
               assignees: ['Dopeamin'],
             });
+
+  auto_merge_dependabot:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]' || contains(github.event.pull_request.labels.*.name, 'auto-merge-test')
+
+    permissions:
+      contents: write
+      pull-requests: write
+      checks: read
+      statuses: read
+
+    steps:
+      - name: Wait for all checks to complete
+        uses: lewagon/wait-on-check-action@v1.3.3
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 10 # seconds between polls
+          # optional: avoid waiting on THIS workflow itself
+          running-workflow-name: "Dependabot high/critical alert issues"
+          check-regexp: "^(?!.*(create_issue_for_high_critical|auto_merge_dependabot)).*$"
+
+      - name: Merge Dependabot PR
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const pr = context.payload.pull_request;
+
+            await github.rest.pulls.merge({
+              owner,
+              repo,
+              pull_number: pr.number,
+              merge_method: 'merge',
+            });
+
+            core.info(`Merged Dependabot PR #${pr.number}`);