github dependabot, allow auto-merge on a restricted set of jobs

17 views Asked by At

In my github project, I have more than 80 different definitions of terraform dependabot jobs (cartesian product of 5 stages and 16 applications).

I want to activate auto-merge on the jobs that concerns the test stage.

Here is a representative extract of some dependabot jobs:

---
version: 2

registries:
  yyyy:
    type: terraform-registry
    url: https://app.terraform.io
    token: ${{ secrets.TFE_REGISTRY_TOKEN }}

updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "ci:"
  - package-ecosystem: "terraform"
    directory: "/xxx/test/database"
    registries:
      - yyyy
    schedule:
      interval: "monthly"
      time: "07:00"
      day: "sunday"
    labels:
      - "test"
    commit-message:
      prefix: "feat:"
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    commit-message:
      prefix: "ci:"
  - package-ecosystem: "terraform"
    directory: "/xxx/dev/database"
    registries:
      - yyyy
    schedule:
      interval: "monthly"
      time: "07:00"
      day: "monday"
    labels:
      - "dev"
    commit-message:
      prefix: "feat:"

and here is the auto-merge workflow definition:

name: Dependabot auto-merge
on: pull_request

permissions:
  contents: write
  pull-requests: write

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    env:
      PR_URL: ${{github.event.pull_request.html_url}}
      GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v1
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"
          skip-verification: true
      - name: Review
        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
        run: gh pr review --approve -b "Dependabot auto-merge patch version" "$PR_URL"
      - name: Enable auto-merge for Dependabot PRs — test stage only
        if: ${{steps.metadata.outputs.update-type == 'version-update:semver-patch'}}
        run: gh pr merge --auto --squash "$PR_URL"

Is it possible to enrich the filter of the step named Enable auto-merge for Dependabot PRs — test stage only with the label set into the dependabot.yml file?

0

There are 0 answers