merge-dependencies.yml

name: 'Merge Dependencies'

on: [pull_request_target]

permissions:
  pull-requests: write
  contents: write

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    # only run for dependabot PRs
    if: github.actor == 'dependabot[bot]'

    steps:
      - name: 'Checkout repository'
        uses: actions/checkout@v3
      - name: 'auto merge dependency updates from Dependabot'
        uses: ahmadnassri/action-dependabot-auto-merge@v2
        # Guarantee that commit comes from Dependabot (don't blindly trust external GitHub Actions)
        if: github.actor == 'dependabot[bot]'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}