dependabot-approve.yml

name: dependabot-approve

on: pull_request_target

permissions: {}

jobs:
  review:
    runs-on: ubuntu-latest
    if: github.event.repository.fork == false && github.event.pull_request.user.login == 'dependabot[bot]'

    permissions:
      contents: read

    steps:

      - name: Get dependabot metadata
        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7 # v2.3.0
        id: dependabot-metadata

      - name: Generate GitHub application token
        id: generate-application-token
        uses: peter-murray/workflow-application-token-action@d17e3a9a36850ea89f35db16c1067dd2b68ee343 # v4.0.1
        with:
          application_id: ${{ secrets.POLLY_REVIEWER_BOT_APP_ID }}
          application_private_key: ${{ secrets.POLLY_REVIEWER_BOT_KEY }}
          permissions: 'contents:write, pull_requests:write, workflows:write'

      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          filter: 'tree:0'
          show-progress: false

      - name: Approve pull request and enable auto-merge
        shell: bash
        if: |
          contains(steps.dependabot-metadata.outputs.dependency-names, 'actions/cache') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'actions/checkout') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'actions/dependency-review-action') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'actions/download-artifact') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'actions/setup-dotnet') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'actions/stale') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'actions/upload-artifact') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'codecov/codecov-action') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'dependabot/fetch-metadata') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'github/codeql-action') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'Microsoft.NET.Test.Sdk') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'Polly') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'Polly.Core') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'Polly.Extensions') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'xunit') ||
          contains(steps.dependabot-metadata.outputs.dependency-names, 'xunit.runner.visualstudio')
        env:
          GH_TOKEN: ${{ steps.generate-application-token.outputs.token }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: |
          gh pr checkout "${PR_URL}"
          if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ];
          then gh pr review --approve "${PR_URL}" && gh pr merge --auto --squash "${PR_URL}"
          fi