From 5825f84b3c309740bc77f263d24816d392b2f4c6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20BIDON?= <fredbi@yahoo.com>
Date: Thu, 1 Feb 2024 08:53:10 +0100
Subject: [PATCH] ci(dependencies): automate dependencies updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>
---
 .github/dependabot.yaml          | 56 ++++++++++++++++++++++++++++++++
 .github/workflows/auto-merge.yml | 43 ++++++++++++++++++++++++
 2 files changed, 99 insertions(+)
 create mode 100644 .github/dependabot.yaml
 create mode 100644 .github/workflows/auto-merge.yml

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
new file mode 100644
index 0000000..976af1b
--- /dev/null
+++ b/.github/dependabot.yaml
@@ -0,0 +1,56 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "friday"
+    open-pull-requests-limit: 2          # <- default is 5
+    groups:                              # <- group all github actions updates in a single PR
+      # 1. development-dependencies are auto-merged
+      development-dependencies:
+        patterns:
+          - '*'
+
+  - package-ecosystem: "gomod"
+    # We define 4 groups of dependencies to regroup update pull requests:
+    # - development (e.g. test dependencies)
+    # - go-openapi updates
+    # - golang.org (e.g. golang.org/x/... packages)
+    # - other dependencies (direct or indirect)
+    #
+    # * All groups are checked once a week and each produce at most 1 PR.
+    # * All dependabot PRs are auto-approved
+    #
+    # Auto-merging policy, when requirements are met:
+    # 1. development-dependencies are auto-merged
+    # 2. golang.org-dependencies are auto-merged
+    # 3. go-openapi patch updates are auto-merged. Minor/major version updates require a manual merge.
+    # 4. other dependencies require a manual merge
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "friday"
+    open-pull-requests-limit: 4
+    groups:
+      development-dependencies:
+        dependency-type: development
+        patterns:
+          - "github.com/stretchr/testify"
+
+      golang.org-dependencies:
+        dependency-type: production
+        patterns:
+          - "golang.org/*"
+
+      go-openapi-dependencies:
+        dependency-type: production
+        patterns:
+          - "github.com/go-openapi/*"
+
+      other-dependencies:
+        dependency-type: production
+        exclude-patterns:
+          - "github.com/go-openapi/*"
+          - "github.com/stretchr/testify"
+          - "golang.org/*"
diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
new file mode 100644
index 0000000..b4009db
--- /dev/null
+++ b/.github/workflows/auto-merge.yml
@@ -0,0 +1,43 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1
+
+      - name: Auto-approve all dependabot PRs
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - name: Auto-merge dependabot PRs for development dependencies
+        if: contains(steps.metadata.outputs.dependency-group, 'development-dependencies')
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - name: Auto-merge dependabot PRs for go-openapi patches
+        if: contains(steps.metadata.outputs.dependency-group, 'go-openapi-dependencies') && (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch')
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - name: Auto-merge dependabot PRs for golang.org updates
+        if: contains(steps.metadata.outputs.dependency-group, 'golang.org-dependencies')
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+