name: Auto-merge Dependabot

on: pull_request

permissions:
  contents: write
  pull-requests: write

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile

      - run: pnpm db:generate

      - run: pnpm test

      # Auto-merge is gated on the Dependabot-declared update type:
      # patch and minor bumps merge once required checks pass; major
      # bumps get a comment and wait for the maintainer. A major bump
      # routinely carries breaking changes the unit suite alone cannot
      # vouch for.
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Enable auto-merge (patch / minor only)
        if: >-
          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
          steps.metadata.outputs.update-type == 'version-update:semver-minor'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Flag major update for manual review
        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
        run: >-
          gh pr comment "$PR_URL" --body
          "Major version bump (${DEP_NAMES}) — auto-merge is intentionally
          disabled for semver-major updates. Review the upstream changelog
          and merge manually."
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}