ci: use dependabot for updates

.github/dependabot.yml

@@ -0,0 +1,81 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: sunday
+    commit-message:
+      prefix: ci
+    labels:
+      - dependencies
+    groups:
+      actions:
+        patterns: ["*"]
+
+  - package-ecosystem: npm
+    versioning-strategy: increase
+    directory: /
+    schedule:
+      interval: weekly
+      day: sunday
+    commit-message:
+      prefix: build(deps)
+    labels:
+      - dependencies
+    groups:
+      npm:
+        patterns: ["*"]
+
+  - package-ecosystem: cargo
+    versioning-strategy: increase-if-necessary
+    directory: /
+    schedule:
+      interval: weekly
+      day: sunday
+    commit-message:
+      prefix: build(deps)
+    labels:
+      - dependencies
+    groups:
+      cargo:
+        patterns: ["*"]
+
+  # - package-ecosystem: pip
+  #   directory: /
+  #   schedule:
+  #     interval: weekly
+  #     day: sunday
+  #   commit-message:
+  #     prefix: build(deps)
+  #   labels:
+  #     - dependencies
+  #   groups:
+  #     pip:
+  #       patterns: ["*"]
+
+  # - package-ecosystem: swift
+  #   directory: /
+  #   schedule:
+  #     interval: weekly
+  #     day: sunday
+  #   commit-message:
+  #     prefix: build(deps)
+  #   labels:
+  #     - dependencies
+  #   groups:
+  #     swift:
+  #       patterns: ["*"]
+
+  # - package-ecosystem: gomod
+  #   directory: /bindings/go
+  #   schedule:
+  #     interval: weekly
+  #     day: sunday
+  #   commit-message:
+  #     prefix: build(deps)
+  #   labels:
+  #     - dependencies
+  #   groups:
+  #     go:
+  #       patterns: ["*"]

.github/workflows/update.yml

@@ -1,9 +1,7 @@
-name: Update dependencies
+name: Handle dependency updates
 
 on:
-  schedule:
-    - cron: "0 0 * * 0" # every week
-  workflow_dispatch:
+  pull_request:
 
 permissions:
   contents: write
@@ -12,17 +10,30 @@ permissions:
 jobs:
   update:
     runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Set up NodeJS
-        uses: actions/setup-node@v4
-        with:
-          cache: npm
-          node-version: ${{vars.NODE_VERSION}}
-      - name: Update dependencies
-        id: update
-        uses: tree-sitter/parser-update-action@v1.1
-        with:
-          parent-name: cpp
-          language-name: arduino
+      - name: Fetch dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+      - name: Update scanner
+        if: steps.metadata.outputs.package-ecosystem == 'npm'
+        run: |-
+          language=$(jq -r .name src/grammar.json)
+          parent=$(gh api --jq '.[]|select(.property_name == "Inherits")|.value' $API_ENDPOINT)
+          sed "s/tree_sitter_${parent}_/tree_sitter_${language}_/" \
+              "node_modules/tree-sitter-${parent}/src/scanner.c" > src/scanner.c
+          if ! git diff --exit-code -- src/scanner.c; then
+            git config user.name "$GITHUB_ACTOR"
+            git config user.email "$GITHUB_ACTOR_ID+$GITHUB_ACTOR@users.noreply.github.com"
+            git add src/scanner.c
+            git commit -m 'chore: update scanner [dependabot skip]'
+            git push
+          fi
+        env:
+          GH_TOKEN: ${{github.token}}
+          API_ENDPOINT: repos/${{github.repository}}/properties/values
+      - name: Enable auto-merge
+        run: gh pr merge --auto --merge $PR_URL
+        env:
+          GH_TOKEN: ${{github.token}}
+          PR_URL: ${{github.event.pull_request.html_url}}