dependabot-reviewer.yml

name: Dependabot reviewer

on: pull_request_target

permissions:
    pull-requests: write
    contents: write

jobs:
    review-dependabot-pr:
        runs-on: ubuntu-latest
        if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
        env:
            PR_URL: ${{ github.event.pull_request.html_url }}
            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        steps:
            - name: Dependabot metadata
              id: dependabot-metadata
              uses: dependabot/fetch-metadata@v2.2.0

            - name: Enable auto-merge for Dependabot PRs
              run: gh pr merge --auto --merge "$PR_URL"

            - name: Approve patch and minor updates
              if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch' || steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor' }}
              run: gh pr review $PR_URL --approve -b "I'm **approving** this pull request because it includes a **${{ steps.dependabot-metadata.outputs.update-type }}**."

            - name: Request review for major updates
              if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' }}
              run: gh pr comment $PR_URL --body "I can't approve this pull request because it includes a **${{ steps.dependabot-metadata.outputs.update-type }}**."