name: Auto-merge Dependabot

on: pull_request

# Nothing outside the one job needs more than a checkout, so the default for
# the workflow is read-only and the write scopes sit on the job that spends
# them: `gh pr merge --auto` writes to the repository's merge queue state, and
# both the merge and the review comment write to the pull request.
permissions:
  contents: read

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 22
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile

      - run: pnpm db:generate

      # The hero-geometry check in the unit suite renders the real panel in a
      # real browser and measures the boxes, and it refuses to skip when CI is
      # set — a check that skips measures nothing. This job runs the same suite
      # as the quality job in `security.yml` and needs the same browser: without
      # it every Dependabot pull request went red on a launch failure that said
      # nothing about the bump (four of them on 2026-09-06 alone). Headless
      # shell only, matching that job.
      - name: Cache Playwright headless shell
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.cache/ms-playwright
          key: playwright-shell-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
          restore-keys: |
            playwright-shell-${{ runner.os }}-

      - run: pnpm exec playwright install --only-shell chromium

      - run: pnpm test

      # Auto-merge is gated on the Dependabot-declared update type:
      # patch and minor bumps merge once required checks pass; major
      # bumps get a comment and wait for the maintainer. A major bump
      # routinely carries breaking changes the unit suite alone cannot
      # vouch for.
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Enable auto-merge (patch / minor only)
        if: >-
          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
          steps.metadata.outputs.update-type == 'version-update:semver-minor'
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Flag major update for manual review
        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
        run: >-
          gh pr comment "$PR_URL" --body
          "Major version bump (${DEP_NAMES}) — auto-merge is intentionally
          disabled for semver-major updates. Review the upstream changelog
          and merge manually."
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}