name: Dependabot automation

on: pull_request

permissions:
  pull-requests: write
  contents: write

jobs:
  merge-auspice-bump:
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
      - id: metadata
        uses: dependabot/fetch-metadata@v3
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      # Run if Auspice is an updated dependency and there are no major version bumps
      # to allow for manual testing before merging.
      - if: |
          contains(fromJSON(steps.metadata.outputs.updated-dependencies-json).*.dependencyName, 'auspice')
          && steps.metadata.outputs.update-type != 'version-update:semver-major'
        run: gh pr merge "${{ github.event.pull_request.html_url }}" --merge
        env:
          GITHUB_TOKEN: ${{ secrets.GH_TOKEN_NEXTSTRAIN_BOT_REPO }}
