name: Dependabot Auto-merge

# Run in the trusted `workflow_run` context and merge Dependabot PRs directly
# with the repository token instead of depending on an external PAT.

on:
  workflow_run:
    types:
      - completed
    workflows:
      # List all required workflow names here.
      - Build

permissions:
  contents: write
  pull-requests: write

jobs:
  auto_merge:
    name: Auto-merge
    runs-on: ubuntu-latest
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.event == 'pull_request' &&
      github.actor == 'dependabot[bot]'

    steps:
      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
        with:
          script: |
            const pr = context.payload.workflow_run.pull_requests?.[0];
            if (!pr) {
              core.setFailed("No pull request found in workflow_run payload.");
              return;
            }

            const { data: pull } = await github.rest.pulls.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: pr.number,
            });

            if (pull.state !== "open") {
              core.info(`PR #${pull.number} is already ${pull.state}; nothing to do.`);
              return;
            }

            if (pull.draft) {
              core.info(`PR #${pull.number} is a draft; skipping.`);
              return;
            }

            await github.rest.pulls.merge({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: pull.number,
              merge_method: "squash",
              sha: context.payload.workflow_run.head_sha,
            });

            core.info(`Merged Dependabot PR #${pull.number}.`);