From 6ea830475e6b1950e89131bbaa0f11e12b446e6c Mon Sep 17 00:00:00 2001
From: Joseph Hale <me@jhale.dev>
Date: Mon, 30 Oct 2023 11:19:46 -0700
Subject: [PATCH] chore: Automerge dependabot PRs via official APIs

The `merge-me` action hasn't been working for me. Let's try the
suggestions from the "Automating Dependabot" docs:
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enable-auto-merge-on-a-pull-request

The new workflow will automatically apply an approval and mark the PR as
available for auto-merging once the status checks complete successfully.

While the example in the docs guards the auto-merge for a specific
dependency, this workflow allows any dependabot PR to be auto-merged.
Use the `dependabot.yml` to constrain which types of PRs dependabot can
open in the first place.
---
 .github/workflows/auto-merge-dependabot.yml | 33 +++++++++++----------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml
index 9e53104..e8654ff 100644
--- a/.github/workflows/auto-merge-dependabot.yml
+++ b/.github/workflows/auto-merge-dependabot.yml
@@ -1,22 +1,23 @@
 name: Auto-merge Dependabot PRs
 
-on:
-  workflow_run:
-    types:
-      - completed
-    workflows:
-      # List all required workflow names here.
-      - 'Run `pre-commit` on PRs'
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
-  merge-me:
-    name: Merge me!
+  dependabot:
     runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
-      - name: Merge me!
-        uses: ridedott/merge-me-action@v2
-        with:
-          GITHUB_LOGIN: dependabot
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          ENABLE_GITHUB_API_PREVIEW: true
-          MERGE_METHOD: REBASE
+      - name: Approve a PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      - name: Enable auto-merge for Dependabot PRs
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
-- 
2.51.2