merge-dependencies.yml

name: 'Merge Dependencies'

# https://github.blog/changelog/2021-02-19-github-actions-workflows-triggered-by-dependabot-prs-will-run-with-read-only-permissions/
# https://github.com/ahmadnassri/action-dependabot-auto-merge/issues/60#issuecomment-806027389
on: [pull_request_target]

jobs:
  auto-merge:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
        node-version: [12.x]
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: 'Checkout repository'
        uses: actions/checkout@v2.3.4
      - name: 'Automerge dependency updates from Dependabot'
        uses: ahmadnassri/action-dependabot-auto-merge@v2.4.0
        # Guarantee that commit comes from Dependabot (don't blindly trust external GitHub Actions)
        if: github.actor == 'dependabot[bot]'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}