Automerge Dependabot PRs #3631

	name: Automerge Dependabot PRs

	# What it does: Automatically merge Dependabot PRs that pass the CI workflow run.
	# Why we have it: To keep our dependencies up-to-date, to avoid security issues.

	on:
	workflow_run:
	workflows: ["CI"]
	types: [completed]

	permissions:
	contents: write
	pull-requests: write

	jobs:
	on-success:
	if: >
	github.event.workflow_run.event == 'pull_request' &&
	github.event.workflow_run.conclusion == 'success' &&
	github.actor == 'dependabot[bot]'
	runs-on: ubuntu-latest
	steps:
	- name: Download artifact
	uses: actions/github-script@v7
	with:
	script: \|
	const { writeFile } = require("node:fs/promises");
	const { owner, repo } = context.repo;

	const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
	owner,
	repo,
	run_id: ${{ github.event.workflow_run.id }},
	});
	const matchArtifact = artifacts.data.artifacts.find(
	(artifact) => artifact.name == "pr"
	);

	const download = await github.rest.actions.downloadArtifact({
	owner,
	repo,
	artifact_id: matchArtifact.id,
	archive_format: "zip",
	});

	await writeFile("${{github.workspace}}/pr.zip", Buffer.from(download.data));

	- name: Unzip artifact
	run: unzip pr.zip

	- name: Merge PR
	uses: actions/github-script@v7
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: \|
	const { readFile } = require("node:fs/promises");
	const { owner, repo } = context.repo;

	const pull_number = Number(await readFile("./NR", "utf8"));

	await github.rest.pulls.merge({
	merge_method: "squash",
	owner,
	repo,
	pull_number,
	});

Provide feedback