Merge pull request #2 from fastify/feat/exclude

feat: allow excluding packages

Author: salmanm

README.md

@@ -8,6 +8,10 @@ This action automatically merges dependabot PRs.
 
 **Required** A github token.
 
+### `exclude`
+
+*Optional* An array of packages that you don't want to auto-merge and would like to manually review to decide whether to upgrade or not.
+
 ## Example usage
 
 ```yml
@@ -30,4 +34,20 @@ jobs:
           github-token: ${{secrets.github_token}}
 ```
 
-Note: The `github_token` is automatically provided by Github Actions, which we access using `secrets.github_token` and supply to the action as an input `github-token`
+**Note**
+
+- The `github_token` is automatically provided by Github Actions, which we access using `secrets.github_token` and supply to the action as an input `github-token`.
+- Make sure to use `needs: <jobs>` to delay the auto-merging until CI checks (test/build) are passed.
+
+## With `exclude`
+
+```yml
+...
+    steps:
+      - uses: fastify/github-action-merge-dependabot@v1
+        if: ${{ github.actor == 'dependabot[bot]' && github.event_name == 'pull_request' }}
+        with:
+          github-token: ${{secrets.github_token}}
+          exclude: ['material-ui']
+...
+```

action.yml

@@ -4,6 +4,10 @@ inputs:
   github-token:
     description: "A GitHub token."
     required: true
+  exclude:
+    description: "Packages that you want to manually review before upgrading"
+    required: false
+    default: []
 runs:
   using: "node12"
   main: "index.js"

index.js

@@ -2,6 +2,7 @@ const core = require('@actions/core')
 const github = require('@actions/github')
 
 const GITHUB_TOKEN = core.getInput('github-token', { required: true })
+const EXCLUDE_PKGS = core.getInput('exclude') || []
 
 const getMergeMethod = (repo) => {
   if (repo.allow_merge_commit) return 'merge'
@@ -21,7 +22,14 @@ async function run () {
     const isDependabotPR = pr.user.login === 'dependabot[bot]'
 
     if (!isDependabotPR) {
-      return console.log('Unable to merge')
+      return core.info('Not dependabot PR, skip merging.')
+    }
+
+    // dependabot branch names are in format "dependabot/npm_and_yarn/pkg-0.0.1"
+    const pkgName = pr.head.ref.split('/').pop().split('-').shift()
+
+    if (EXCLUDE_PKGS.includes(pkgName)) {
+      return core.info(`${pkgName} is excluded, skip merging.`)
     }
 
     await octokit.pulls.createReview({