- Switch trigger to `pull_request_target` with `opened`, `synchronize`, and `reopened` events for safer automation
- Add explicit check that the actor is `dependabot[bot]` to prevent unintended executions
- Use `GITHUB_TOKEN` instead of a dedicated secret and enable `use-github-auto-merge` for automatic merging of minor updates
Refines the Dependabot auto-merge workflow by removing unnecessary whitespace, simplifying the conditional syntax, and updating the token reference for improved security.
**Enhancements & Refinements**
- Removed leading whitespace at the start of the file for cleaner formatting
- Simplified the `if` condition syntax from `${{github.actor == 'dependabot[bot]' }}` to `github.actor == 'dependabot[bot]'`
- Updated the GitHub token reference from `secrets.GITHUB_TOKEN` to `secrets.DEPENDABOT_TOKEN` for better security practices
- Fixed capitalization in step name from "Merge PR from dependabot" to "Merge PR from Dependabot" for consistency
```
The dependabot auto-merge workflow has been updated to use a new action and simplified logic for merging pull requests.
- **Enhancements & Refinements**:
- Replaced `dependabot/fetch-metadata` and `peter-evans/enable-pull-request-automerge` with `fastify/github-action-merge-dependabot`
- Simplified the workflow by removing conditional logic for update types
- Updated the condition syntax to use explicit expression syntax
- Added explicit `github-token` configuration for the new action
```
The Dependabot auto-merge workflow has been simplified and focused on essential functionality. Approval steps have been removed, leaving only the core auto-merge capability for minor and patch updates.
**New Features**
- Added explicit conditional filtering to run jobs **only for Dependabot PRs**
**Enhancements & Refinements**
- Renamed workflow from **Dependabot Auto-Approve and Auto-Merge** to **Dependabot Auto-Merge** to reflect simplified scope
- Improved workflow structure with clearer YAML syntax separation
- Reorganized **Fetch Dependabot metadata** step placement for better readability
- Removed redundant GitHub script approval step to reduce complexity
sankalp