dependabot-auto.yml

name: Dependabot auto-approve
on: pull_request_target

permissions:
  pull-requests: write
  contents: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          token: ${{ secrets.GH_PAT }}
      - name: Update dist folder
        run: npm ci && npm run dist
      - name: Commit dist folder
        uses: stefanzweifel/git-auto-commit-action@v5
        id: commit
        with:
          commit_message: "[dependabot skip] Update dist"
          commit_options: --no-verify --allow-empty
          skip_dirty_check: true
          file_pattern: dist
      - name: Wait PR Ready
        if: steps.commit.outputs.changes_detected  == 'true'
        run: |
          for I in 1 2 3 4 5
          do
            gh pr list --search "${{steps.commit.outputs.commit_hash}}" --state open --json id \
             | jq -e '. | length == 0' || break
            echo "Commit not yet landed in PR, waiting 2s"
            sleep 2
          done
        env:
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

      - name: Approve and Auto-merge dependabot PR
        run: |
          gh pr review --approve "$PR_URL"
          gh pr merge --auto --squash --delete-branch "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}