# This workflow is provided via the organization template repository
#
# https://github.com/nextcloud/.github
# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
#
# SPDX-FileCopyrightText: Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: MIT

name: Auto approve Dependabot PRs

on:
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    branches:
      - main
      - master
      - stable*

permissions:
  contents: read

concurrency:
  group: dependabot-approve-merge-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  auto-approve-merge:
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest-low
    env:
      ALLOW_MINOR: false
      IGNORE_PATTERN: '(webrtc-adapter|\@nextcloud\/vue)'
    permissions:
      # for hmarr/auto-approve-action to approve PRs
      pull-requests: write
      # for alexwilson/enable-github-automerge-action to approve PRs
      contents: write

    steps:
      - name: Disabled on forks
        if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
        run: |
          echo 'Can not approve PRs from forks'
          exit 1

      - name: Dependabot metadata
        if: github.event.pull_request.user.login == 'dependabot[bot]'
        id: metadata
        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Check allowed dependency update
        if: github.event.pull_request.user.login == 'dependabot[bot]'
        id: validate
        env:
          IGNORE_PATTERN: ${{ env.IGNORE_PATTERN }}
          DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
        run: |
          if [[ -z ${IGNORE_PATTERN} ]]; then
              echo "ignore=false" >> "$GITHUB_OUTPUT"
          elif [[ -z ${DEPENDENCY_NAMES} ]]; then
              echo "ignore=false" >> "$GITHUB_OUTPUT"
          elif [[ ${DEPENDENCY_NAMES} =~ ${IGNORE_PATTERN} ]]; then
              echo "ignore=true" >> "$GITHUB_OUTPUT"
          fi

      # GitHub actions bot approve
      - name: Auto approve
        id: auto_approve
        uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
        if: ${{ github.event.pull_request.user.login == 'dependabot[bot]'
            && steps.validate.outputs.ignore != 'true'
            && ((fromJSON(env.ALLOW_MINOR) && steps.metadata.outputs.update-type == 'version-update:semver-minor')
                || steps.metadata.outputs.update-type == 'version-update:semver-patch')
            }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      # Enable GitHub auto merge
      - name: Auto merge
        uses: alexwilson/enable-github-automerge-action@56e3117d1ae1540309dc8f7a9f2825bc3c5f06ff # v2.0.0
        if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && steps.auto_approve.conclusion == 'success' }}
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}