update_dependabot_branch.yml

name: Update dependabot branch
on:
  #   schedule:
  #     - cron: "0 5 * * 1-5"
  #   # allow the GitHub Action to be triggered manually
  #   workflow_dispatch:
  pull_request:
    branches: [master]
  workflow_dispatch:

jobs:
  update_branch:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: make empty commit to dependabot branch
        id: empty_dependabot
        env:
          GITHUB_DEPENDABOT_TOKEN: ${{ secrets.GH_TOKEN_DEPENDABOT_COMMIT }}
          GH_TOKEN: ${{ github.token }}
        run: |
          pr_number=$(gh pr list -S 'author:app/dependabot' --json number -q '.[0].number')
          branch_name=$(gh pr view $pr_number --json headRefName -q '.headRefName')
          git fetch
          git checkout $branch_name
          git config --global credential.helper '!f() { sleep 1; echo "username=git token=<TOKEN>"; }; f'
          git config user.email "chris.every@kaluza.com"
          git config user.name "eversC"
          git commit --allow-empty -m "Empty commit to force CI/CD"
          git remote remove origin
          git remote add origin https://$GITHUB_DEPENDABOT_TOKEN@github.com/ovotech/cloud-key-rotator
          git push origin $branch_name