chore: sync files from wearepixel/pixel-workflows - synced local '.github/workflows/dependabot-auto-merge.yml' with remote 'files/.github/workflows/dependabot-auto-merge.yml'

.github/workflows/dependabot-auto-merge.yml

@@ -1,32 +1,59 @@
-name: dependabot-auto-merge
-on: pull_request_target
+name: Dependabot Auto-merge
+
+on:
+  workflow_run:
+    workflows: ["Tests"]
+    types: [completed]
 
 permissions:
-  pull-requests: write
   contents: write
+  pull-requests: write
 
 jobs:
-  dependabot:
+  auto-merge:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
+
     steps:
-
-      - name: Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Auto-merge Dependabot PRs for semver-minor updates
-        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-minor'}}
-        run: gh pr merge --auto --merge "$PR_URL"
+      - name: Find PR and check update type
+        id: check
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          PR_DATA=$(gh pr list --repo "${{ github.repository }}" --head "$HEAD_BRANCH" --json number,title,url,author --jq '.[0]')
 
-      - name: Auto-merge Dependabot PRs for semver-patch updates
-        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
-        run: gh pr merge --auto --merge "$PR_URL"
+          PR_URL=$(echo "$PR_DATA" | jq -r '.url')
+          PR_AUTHOR=$(echo "$PR_DATA" | jq -r '.author.login')
+          PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+
+          echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
+
+          if [ "$PR_AUTHOR" != "app/dependabot" ]; then
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Not a Dependabot PR, skipping."
+            exit 0
+          fi
+
+          # Parse major version numbers from title: "bump X from A[.B.C] to D[.E.F]"
+          # Works for both "from 4.0.0 to 4.1.0" and "from 4 to 6" (GitHub Actions)
+          FROM_MAJOR=$(echo "$PR_TITLE" | grep -oP 'from \K[0-9]+')
+          TO_MAJOR=$(echo "$PR_TITLE" | grep -oP 'to \K[0-9]+')
+
+          echo "PR: $PR_TITLE (major: $FROM_MAJOR -> $TO_MAJOR)"
+
+          if [ "$FROM_MAJOR" = "$TO_MAJOR" ]; then
+            echo "is_safe=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Major version bump, skipping auto-merge."
+          fi
+
+      - name: Merge minor and patch updates
+        if: steps.check.outputs.is_safe == 'true'
+        run: gh pr merge --merge "${{ steps.check.outputs.pr_url }}"
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}