dependabot.yaml

on:
  pull_request:
    branches: [ main ]

permissions:
  contents: write
  pull-requests: write

jobs:
  release:
    runs-on: ubuntu-24.04
    name: Auto-approve dependabot PRs for minor or test-only dependency upgrades
    steps:
    - name: Install sqlite headers and cross-compilation packages
      run: sudo apt-get install -y libsqlite3-dev qemu-user libc6-armhf-cross libc6-arm64-cross libc6-amd64-cross 
    - uses: actions/checkout@v4
    - uses: actions/setup-go@v5
      with:
        go-version: ^1.22.0
    - uses: goto-bus-stop/setup-zig@v2
    - run: ./release.sh
    - uses: actions/upload-artifact@v4
      with:
        name: release
        path: release/*
    - name: Dependabot metadata
      if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
      id: dependabot-metadata
      uses: dependabot/fetch-metadata@v2.2.0
    - name: Enable auto-merge for Dependabot PRs
      if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
      run: gh pr merge --auto --rebase "$PR_URL"
      env:
        PR_URL: ${{github.event.pull_request.html_url}}
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
    - name: Approve patch and minor updates for Dependabot PRs
      if: ${{ (github.event.pull_request.user.login == 'dependabot[bot]') &&
          ((steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch') || (steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor')) }}
      run: gh pr review $PR_URL --approve -b "I'm **approving** this pull request because **it includes a patch or minor update**"
      env:
        PR_URL: ${{github.event.pull_request.html_url}}
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
    - name: Approve major updates of development dependencies for Dependabot PRs
      if: ${{ (github.event.pull_request.user.login == 'dependabot[bot]') &&
          (steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major') && (steps.dependabot-metadata.outputs.dependency-type == 'direct:development') }}
      run: gh pr review $PR_URL --approve -b "I'm **approving** this pull request because **it includes a major update of a dependency used only in development**"
      env:
        PR_URL: ${{github.event.pull_request.html_url}}
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
    - name: Comment on major updates of non-development dependencies for Dependabot PRs
      if: ${{ (github.event.pull_request.user.login == 'dependabot[bot]') &&
          (steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major') && (steps.dependabot-metadata.outputs.dependency-type == 'direct:production') }}
      run: |
        gh pr comment $PR_URL --body "I'm **not approving** this PR because **it includes a major update of a dependency**"
        gh pr edit $PR_URL --add-label "requires-manual-qa"
      env:
        PR_URL: ${{github.event.pull_request.html_url}}
        GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}