dependabot.yaml

name: auto-merge

on:
    pull_request_target:

jobs:
    auto-merge:
        runs-on: ubuntu-20.04
        if: ${{ github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.fork == false }}
        permissions:
            issues: write
            pull-requests: write
            contents: write
            packages: write
        steps:
            - name: Checkout
              uses: actions/checkout@v3
              with:
                  ref: ${{ github.event.pull_request.head.sha }}

            - name: Check if Dockerfile is building
              uses: docker/build-push-action@v4
              with:
                  context: .
                  push: false
                  tags: "waf-proxy"
                  github-token: ${{ secrets.GITHUB_TOKEN }}

            - name: Test image
              run: "make test IMAGE=waf-proxy"

            - name: Scan image
              uses: aquasecurity/trivy-action@0.9.1
              with:
                  image-ref: "ghcr.io/riotkit-org/waf-proxy:${{ steps.tag.outputs.TAG }}"
                  format: 'table'

            - name: Dependabot metadata
              id: metadata
              uses: dependabot/fetch-metadata@v1.3.6
              with:
                  github-token: "${{ secrets.GITHUB_TOKEN }}"

            - name: Merge Pull Request
              if: ${{steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
              run: gh pr merge --auto --merge "$PR_URL"
              env:
                  PR_URL: ${{github.event.pull_request.html_url}}
                  GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

            - name: Checkout back to main branch
              uses: actions/checkout@v3
              with:
                  ref: main
                  github-token: ${{ secrets.GITHUB_TOKEN }}

            - name: Bump version and push tag
              id: tag_version
              uses: mathieudutour/github-tag-action@v6.1
              with:
                  github_token: ${{ secrets.GITHUB_TOKEN }}

            - name: Create a GitHub release
              uses: ncipollo/release-action@v1
              with:
                  tag: ${{ steps.tag_version.outputs.new_tag }}
                  name: Release ${{ steps.tag_version.outputs.new_tag }}
                  body: ${{ steps.tag_version.outputs.changelog }}
                  token: ${{ secrets.GH_RW_TOKEN }}