approve-dependabot.yml

# SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
# SPDX-License-Identifier: Apache-2.0

# @example=## Dependabot Approver Sample
## SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
## SPDX-License-Identifier: Apache-2.0
#---
#name: 'Approve Dependabot'
#
#on:
#  pull_request_target:
#
#jobs:
#  dependabot:
#    uses: xmidt-org/shared-go/.github/workflows/ci.yml@6a0bec30f42c318c0c1d06705f3f60911ed7c610 # v3.2.0
#    secrets: inherit
---
name: 'Approve Dependabot Workflow'

on:
  workflow_call:

jobs:
  dependabot:
    permissions:
      pull-requests: write
      contents: write

    runs-on: [ ubuntu-latest ]
    # Checking the actor will prevent your Action run failing on non-Dependabot
    # PRs but also ensures that it only does work for Dependabot PRs.
    if: |
      github.actor == 'dependabot[bot]'
    steps:
      # The real protection is in dependabot configuration and that the repo
      # builds, runs tests and they succeed.
      - name: Approve a PR & mark for auto apply.
        run: |
          gh pr merge --auto --squash "$PR_URL"
          gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}