Automerge Dependabot PRs #430

	name: Automerge Dependabot PRs

	# What it does: Automatically merge Dependabot PRs that pass the CI workflow run.
	# Why we have it: To keep our dependencies up-to-date, to avoid security issues.

	on:
	workflow_run:
	workflows: ["CI"]
	types: [completed]

	permissions:
	contents: write
	pull-requests: write

	jobs:
	on-success:
	if: >
	github.event.workflow_run.event == 'pull_request' &&
	github.event.workflow_run.conclusion == 'success' &&
	github.actor == 'dependabot[bot]'
	runs-on: ubuntu-latest
	steps:
	- name: Download artifact
	uses: actions/github-script@v7
	with:
	script: \|
	const fs = require('fs');

	const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
	owner: context.repo.owner,
	repo: context.repo.repo,
	run_id: ${{ github.event.workflow_run.id }},
	});
	const matchArtifact = artifacts.data.artifacts.filter((artifact) => {
	return artifact.name == 'pr';
	})[0];

	const download = await github.rest.actions.downloadArtifact({
	owner: context.repo.owner,
	repo: context.repo.repo,
	artifact_id: matchArtifact.id,
	archive_format: 'zip',
	});

	fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));

	- name: Unzip artifact
	run: unzip pr.zip

	- name: Merge PR
	uses: actions/github-script@v7
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: \|
	const fs = require('fs');
	const pull_number = Number(fs.readFileSync('./NR'));

	await github.rest.pulls.merge({
	merge_method: "squash",
	owner: context.repo.owner,
	repo: context.repo.repo,
	pull_number: pull_number,
	});

Provide feedback