automerge.yml

---
name: "Dependabot auto-merge"
on: pull_request

permissions: {}

jobs:
  automerge:
    permissions:
      # Required to merge the PR
      contents: write
      # Required to merge the PR if it modifies a workflow
      actions: write
      # Required to approve the PR
      pull-requests: write
    runs-on: ubuntu-latest
    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
    steps:
      - name: Enable auto-merge for Dependabot PRs
        shell: bash
        run: |
          set -euo pipefail
          IFS=$'\n\t'
          # Checking the PR title is a poor substitute for the actual PR changes
          # but as long as this is used only with dependabot PRs,
          # it should be safe to assume that the title is not misleading.
          regexp='[Bb]ump .* from [0-9]+\.[0-9]+(\.[0-9]+)?(\.[0-9]+)?(\-[a-z]+)? to [0-9]+\.[0-9]+(\.[0-9]+)?(\.[0-9]+)?(\-[a-z]+)?( in .*)?$'
          if ! [[ "${PR_TITLE}" =~ ${regexp} ]] ; then
            echo 'Non-semver upgrade, needs manual review.'
          elif [ "${BASH_REMATCH[3]}" != "${BASH_REMATCH[6]}" ] ; then
            echo 'Version suffixes do not match, needs manual review.'
          else
            echo 'Automated review approval.'
            gh pr review --approve "${PR_URL}"
          fi
          gh pr merge --auto --squash "${PR_URL}"
        env:
          PR_TITLE: ${{github.event.pull_request.title}}
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}