spiffworkflow-frontend/.github/workflows/auto-merge-dependabot-prs.yml

name: Dependabot auto-merge
on:
  workflow_run:
    workflows: ["Tests"]
    # completed does not mean success of Tests workflow. see below checking github.event.workflow_run.conclusion
    types:
      - completed

# workflow_call is used to indicate that a workflow can be called by another workflow. When a workflow is triggered with the workflow_call event, the event payload in the called workflow is the same event payload from the calling workflow. For more information see, "Reusing workflows."

# https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request
# maybe hook into this instead of workflow_run:
# on:
#   pull_request:
#   pull_request_target:
#     types: [labeled]

permissions:
  contents: write

jobs:
  printJob:
    name: Print event
    runs-on: ubuntu-latest
    steps:
    - name: Dump GitHub context
      env:
        GITHUB_CONTEXT: ${{ toJson(github) }}
      run: |
        echo "$GITHUB_CONTEXT"
  dependabot:
    runs-on: ubuntu-latest
    # FIXME: uncomment after logging confirms actor is dependabot
    # if: ${{ github.actor == 'dependabot[bot]' && github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Log github metadata for debugging
        # if: ${{contains(steps.metadata.outputs.dependency-names, 'pytest') && steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
        # if: ${{contains(steps.metadata.outputs.dependency-names, 'pytest')}}
        # ideally we auto-merge if all checks pass
        run: |
          echo about to log stuff from webhook
          echo actor: ${{ github.actor }}
          echo conclusion: ${{ github.event.workflow_run.conclusion }}
          echo event_name: ${{ github.event_name }}
          echo pr_url: ${{ github.event.pull_request.html_url }}
          echo workflow: ${{ github.workflow }}
          echo and going to next step where it should auto merge
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

      # we saved the pr_number in tests.yml. fetch it so we can merge the correct PR.
      # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run
      - name: 'Download artifact'
        uses: actions/github-script@v6
        with:
          script: |
            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
              owner: context.repo.owner,
              repo: context.repo.repo,
              run_id: context.payload.workflow_run.id,
            });
            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
              return artifact.name == "pr_number"
            })[0];
            let download = await github.rest.actions.downloadArtifact({
              owner: context.repo.owner,
              repo: context.repo.repo,
              artifact_id: matchArtifact.id,
              archive_format: 'zip',
            });
            let fs = require('fs');
            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/pr_number.zip`, Buffer.from(download.data));

      - name: 'Unzip artifact'
        run: unzip pr_number.zip
      #
      # - name: Dependabot metadata
      #   id: metadata
      #   uses: dependabot/fetch-metadata@v1.3.1
      #   with:
      #     github-token: "${{ secrets.GITHUB_TOKEN }}"

      - name: actually merge it
        # if: ${{contains(steps.metadata.outputs.dependency-names, 'pytest') && steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
        # if: ${{contains(steps.metadata.outputs.dependency-names, 'pytest')}}
        # ideally we auto-merge if all checks pass
        # run: gh pr merge --auto --merge "$PR_URL"
        run: gh pr merge --auto --merge "$(cat pr_number)"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}