snapshot of https://github.com/ActivityWatch/aw-server-rust.git (master, 2026-09-16; blobs > 131072B omitted)

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,61 @@
+name: Dependabot Auto-merge
+
+# Run in the trusted `workflow_run` context and merge Dependabot PRs directly
+# with the repository token instead of depending on an external PAT.
+
+on:
+  workflow_run:
+    types:
+      - completed
+    workflows:
+      # List all required workflow names here.
+      - Build
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto_merge:
+    name: Auto-merge
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.actor == 'dependabot[bot]'
+
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
+        with:
+          script: |
+            const pr = context.payload.workflow_run.pull_requests?.[0];
+            if (!pr) {
+              core.setFailed("No pull request found in workflow_run payload.");
+              return;
+            }
+
+            const { data: pull } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+            });
+
+            if (pull.state !== "open") {
+              core.info(`PR #${pull.number} is already ${pull.state}; nothing to do.`);
+              return;
+            }
+
+            if (pull.draft) {
+              core.info(`PR #${pull.number} is a draft; skipping.`);
+              return;
+            }
+
+            await github.rest.pulls.merge({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pull.number,
+              merge_method: "squash",
+              sha: context.payload.workflow_run.head_sha,
+            });
+
+            core.info(`Merged Dependabot PR #${pull.number}.`);