From 07d155159d2eb1c0a690e7e511334b40600e25a7 Mon Sep 17 00:00:00 2001
From: "pixel-workflows[bot]"
 <272721430+pixel-workflows[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 08:21:39 +0000
Subject: [PATCH] chore: sync files from wearepixel/pixel-workflows - synced
 local '.github/workflows/dependabot-auto-merge.yml' with remote
 'files/.github/workflows/dependabot-auto-merge.yml'

---
 .github/workflows/dependabot-auto-merge.yml | 71 ++++++++++++++-------
 1 file changed, 49 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 13e1278..4e9fb7c 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -1,32 +1,59 @@
-name: dependabot-auto-merge
-on: pull_request_target
+name: Dependabot Auto-merge
+
+on:
+  workflow_run:
+    workflows: ["Tests"]
+    types: [completed]
 
 permissions:
-  pull-requests: write
   contents: write
+  pull-requests: write
 
 jobs:
-  dependabot:
+  auto-merge:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
+
     steps:
-
-      - name: Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-        with:
-          github-token: "${{ secrets.GITHUB_TOKEN }}"
-
-      - name: Auto-merge Dependabot PRs for semver-minor updates
-        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-minor'}}
-        run: gh pr merge --auto --merge "$PR_URL"
+      - name: Find PR and check update type
+        id: check
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          PR_DATA=$(gh pr list --repo "${{ github.repository }}" --head "$HEAD_BRANCH" --json number,title,url,author --jq '.[0]')
 
-      - name: Auto-merge Dependabot PRs for semver-patch updates
-        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
-        run: gh pr merge --auto --merge "$PR_URL"
+          PR_URL=$(echo "$PR_DATA" | jq -r '.url')
+          PR_AUTHOR=$(echo "$PR_DATA" | jq -r '.author.login')
+          PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+
+          echo "pr_url=$PR_URL" >> $GITHUB_OUTPUT
+
+          if [ "$PR_AUTHOR" != "app/dependabot" ]; then
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Not a Dependabot PR, skipping."
+            exit 0
+          fi
+
+          # Parse major version numbers from title: "bump X from A[.B.C] to D[.E.F]"
+          # Works for both "from 4.0.0 to 4.1.0" and "from 4 to 6" (GitHub Actions)
+          FROM_MAJOR=$(echo "$PR_TITLE" | grep -oP 'from \K[0-9]+')
+          TO_MAJOR=$(echo "$PR_TITLE" | grep -oP 'to \K[0-9]+')
+
+          echo "PR: $PR_TITLE (major: $FROM_MAJOR -> $TO_MAJOR)"
+
+          if [ "$FROM_MAJOR" = "$TO_MAJOR" ]; then
+            echo "is_safe=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_safe=false" >> $GITHUB_OUTPUT
+            echo "Major version bump, skipping auto-merge."
+          fi
+
+      - name: Merge minor and patch updates
+        if: steps.check.outputs.is_safe == 'true'
+        run: gh pr merge --merge "${{ steps.check.outputs.pr_url }}"
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}