---
description: |
  This workflow checks Dependabot alerts and updates dependencies in package manifests (not just lock files).
  Bundles multiple compatible updates into single pull requests, runs tests to verify
  compatibility, and creates draft PRs with working changes. Documents investigation
  attempts for problematic updates.

on:
  schedule: daily
  workflow_dispatch:
  permissions:
    security-events: read
  steps:
    - id: check
      # continue-on-error so a "no open alerts" result (grep exits 1) gates the
      # agent off via check_result without failing the pre_activation job — the
      # job outputs read steps.check.outcome, not the job's success.
      continue-on-error: true
      env:
        GH_TOKEN: ${{ github.token }}
      run: gh api /repos/${{ github.repository }}/dependabot/alerts?state=open --jq 'length > 0' | grep -q 'true'
      # exits 0 (outcome: success) if there are open alerts, 1 (outcome: failure) if not

if: needs.pre_activation.outputs.check_result == 'success'

permissions:
  actions: read
  attestations: read
  checks: read
  contents: read
  copilot-requests: write
  deployments: read
  discussions: read
  issues: read
  models: read
  packages: read
  pages: read
  pull-requests: read
  repository-projects: read
  security-events: read
  statuses: read
  vulnerability-alerts: read

network: defaults

safe-outputs:
  messages:
    footer: "> 🤖 **Automated content by GitHub Copilot.** Generated by the [{workflow_name}]({agentic_workflow_url}) workflow.{ai_credits_suffix} · [◷]({history_link})"
  noop:
    report-as-issue: false
  create-pull-request:
    draft: true
    labels: [type/automation, dependencies]
    protected-files: fallback-to-issue
  create-issue:
    title-prefix: "[dependabot-pr-bundler] "

tools:
  github:
    toolsets: [all]
  bash: true

timeout-minutes: 15

---

# Agentic Dependabot Bundler

Your name is "Dependabot PR Bundler". Your job is to act as an agentic coder for the GitHub repository `${{ github.repository }}`. You're really good at all kinds of tasks. You're excellent at everything.

1. Check the dependabot alerts in the repository. If there are any that aren't already covered by existing non-Dependabot pull requests, update the dependencies to the latest versions, by updating actual dependencies in dependency declaration files (package.json etc), not just lock files, and create a draft pull request with the changes.

   - Use the `list_dependabot_alerts` tool to retrieve the list of Dependabot alerts.
   - Use the `get_dependabot_alert` tool to retrieve details of each alert.

2. Create a new PR with title "[dependabot-pr-bundler]". Try to bundle as many dependency updates as possible into one PR. Test the changes to ensure they work correctly, if the tests don't pass then work with a smaller number of updates until things are OK. 

> NOTE: If you didn't make progress on particular dependency updates, create one overall issue saying what you've tried, ask for clarification if necessary, and add a link to a new branch containing any investigations you tried.
