on_new_pr.yml

name: Pull Request
on:
  # https://securitylab.github.com/research/github-actions-preventing-pwn-requests
  # could and should work, at least for public repos;
  # tracking issue for this action's issue:
  # https://github.com/ahmadnassri/action-dependabot-auto-merge/issues/60
  pull_request_target:
    types:
    - opened
    - edited
    - reopened
    - synchronize
    - ready_for_review

permissions:
  contents: read

jobs:
  enable-auto-merge:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write

    # Specifically check that dependabot (or another trusted party) created this pull-request, and that it has been labelled correctly.
    if: contains(github.event.pull_request.labels.*.name, 'dependencies')
    steps:
    - uses: alexwilson/enable-github-automerge-action@2.0.0
      with:
        github-token: ${{secrets.SOURCE_PUSH_TOKEN}}
        merge-method: "MERGE"

  auto_approve_dependabot:
    runs-on: ubuntu-latest

    permissions:
      contents: write
      pull-requests: write

    if: contains(github.event.pull_request.labels.*.name, 'dependencies')
    steps:
    - uses: hmarr/auto-approve-action@v4
      with:
        github-token: ${{secrets.SOURCE_PUSH_TOKEN}}