sankalp
4a03328b33
- Switch trigger to `pull_request_target` with `opened`, `synchronize`, and `reopened` events for safer automation - Add explicit check that the actor is `dependabot[bot]` to prevent unintended executions - Use `GITHUB_TOKEN` instead of a dedicated secret and enable `use-github-auto-merge` for automatic merging of minor updates
23 lines
544 B
YAML
23 lines
544 B
YAML
name: Dependabot Auto-Merge
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
dependabot:
|
|
runs-on: ubuntu-latest
|
|
# Check that it's actually dependabot
|
|
if: github.event.pull_request.user.login == 'dependabot[bot]'
|
|
steps:
|
|
- name: Merge PR from Dependabot
|
|
uses: fastify/github-action-merge-dependabot@v3
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
use-github-auto-merge: true
|
|
target: minor
|