dependabot.yml

# Automatically approve and merge dependabot PRs.

name: Dependabot

on:
  pull_request:
    branches: ["*"]

# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
permissions:
  issues: write
  pull-requests: write

jobs:
  approve:
    name: Approve Dependabot PRs
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'

    steps:
      - uses: octokit/request-action@v2.4.0
        if: contains(fromJSON('["opened", "reopened"]'), github.event.action)
        with:
          route: POST /repos/{owner_and_repo}/pulls/{pull_number}/reviews
          owner_and_repo: ${{ github.repository }}
          pull_number: ${{ github.event.pull_request.number }}
          event: "APPROVE"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - uses: octokit/request-action@v2.4.0
        if: contains(fromJSON('["opened", "reopened"]'), github.event.action)
        with:
          route: POST /repos/{owner_and_repo}/issues/{pull_number}/comments
          owner_and_repo: ${{ github.repository }}
          pull_number: ${{ github.event.pull_request.number }}
          # two quotes are needed to avoid a syntax error when running the action
          body: "'@dependabot squash and merge'"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}