1 automerge to rule them all

Author: delphiactual

.github/workflows/auto-merge.yml

@@ -0,0 +1,50 @@
+name: Auto-merge
+
+on:
+  pull_request_target:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'd2ai-bot' || github.actor == 'dependabot[bot]'
+    steps:
+      - name: Generate token
+        uses: actions/create-github-app-token@v2
+        id: app-token
+        with:
+          app-id: ${{ secrets.AUTOMERGE_APP_ID }}
+          private-key: ${{ secrets.AUTOMERGE_PRIVATE_KEY }}
+
+      - name: Check Dependabot metadata
+        if: github.actor == 'dependabot[bot]'
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+
+      - name: Determine if should auto-merge
+        id: should-merge
+        run: |
+          if [ "${{ github.actor }}" == "d2ai-bot" ]; then
+            echo "Auto-merge approved for d2ai-bot"
+            echo "approved=true" >> $GITHUB_OUTPUT
+          elif [ "${{ github.actor }}" == "dependabot[bot]" ]; then
+            UPDATE_TYPE="${{ steps.metadata.outputs.update-type }}"
+            if [ "$UPDATE_TYPE" == "version-update:semver-patch" ] || [ "$UPDATE_TYPE" == "version-update:semver-minor" ]; then
+              echo "Auto-merge approved for Dependabot ($UPDATE_TYPE)"
+              echo "approved=true" >> $GITHUB_OUTPUT
+            else
+              echo "Auto-merge skipped for Dependabot ($UPDATE_TYPE is major or unknown)"
+              echo "approved=false" >> $GITHUB_OUTPUT
+            fi
+          fi
+
+      - name: Enable auto-merge
+        if: steps.should-merge.outputs.approved == 'true'
+        run: gh pr merge --auto --merge "${{ github.event.pull_request.html_url }}"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}