Repository navigation
chore(deps): bump the python-dependencies group with 2 updates #116
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # NOTE: This workflow expects that branch protection rules require all checks to pass before merging. | ||
|
Check warning on line 1 in .github/workflows/dependabot.yml
|
||
| # Auto-merge will only occur if all required status checks and reviews are successful. | ||
| # | ||
| # NOTE: pull_request_target is used instead of pull_request so that GITHUB_TOKEN has write | ||
| # permissions (needed for gh pr review / gh pr merge). Workflows triggered by pull_request from | ||
| # Dependabot run with a read-only token and cannot approve or merge PRs. | ||
| # | ||
| # SECURITY: pull_request_target runs workflow code from the BASE branch (master), not the PR branch, | ||
| # so a malicious PR cannot inject code that runs with the write token. This is safe here because: | ||
| # - No actions/checkout step exists — PR code is never executed. | ||
| # - The job is guarded by `if: github.event.pull_request.user.login == 'dependabot[bot]'`. | ||
| # WARNING: Never add actions/checkout (especially with the PR head ref) to this workflow — doing so | ||
| # would create an RCE vector where untrusted code runs with a write-capable token. | ||
| name: Dependabot auto-approve and auto-merge | ||
| on: | ||
| pull_request_target: | ||
| types: [opened, synchronize] | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| jobs: | ||
| dependabot: | ||
| name: Auto-approve and auto-merge Dependabot PRs | ||
| runs-on: ubuntu-latest | ||
| if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'AbsaOSS/generate-release-notes' | ||
| steps: | ||
| - name: Dependabot metadata | ||
| id: metadata | ||
| uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 | ||
| with: | ||
| github-token: "${{ secrets.GITHUB_TOKEN }}" | ||
| - name: Approve a PR | ||
| run: gh pr review --approve "$PR_URL" | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Enable auto-merge for Dependabot PRs | ||
| if: startsWith(steps.metadata.outputs.update-type, 'version-update') || startsWith(steps.metadata.outputs.update-type, 'security') | ||
| run: gh pr merge --auto --squash "$PR_URL" | ||
| continue-on-error: true | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
