Automate dependency update merges

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 10

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,103 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: dependabot-auto-merge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  authorize-dependency-update:
+    if: >-
+      github.event.repository.fork == false &&
+      github.actor == 'dependabot[bot]' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (startsWith(github.event.pull_request.head.ref, 'dependabot/npm_and_yarn/') ||
+      startsWith(github.event.pull_request.head.ref, 'dependabot/github_actions/')) &&
+      github.event.pull_request.base.ref == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Authorize dependency update files
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          case "${HEAD_REF}" in
+            dependabot/npm_and_yarn/*) ecosystem="npm" ;;
+            dependabot/github_actions/*) ecosystem="github-actions" ;;
+            *)
+              echo "Refusing auto-merge; unsupported Dependabot branch: ${HEAD_REF}"
+              exit 1
+              ;;
+          esac
+          changed_files="$(gh api --paginate \
+            "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" \
+            --jq '.[].filename')"
+          if [[ -z "${changed_files}" ]]; then
+            echo "Refusing auto-merge; the pull request has no changed files."
+            exit 1
+          fi
+          while IFS= read -r changed_file; do
+            case "${ecosystem}:${changed_file}" in
+              npm:package.json | npm:package-lock.json) ;;
+              github-actions:.github/workflows/*.yml | github-actions:.github/workflows/*.yaml) ;;
+              github-actions:action.yml | github-actions:action.yaml) ;;
+              *)
+                echo "Refusing auto-merge; changed files were:"
+                echo "${changed_files}"
+                exit 1
+                ;;
+            esac
+          done <<< "${changed_files}"
+
+  enable-auto-merge:
+    needs: authorize-dependency-update
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Enable auto-merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr merge --auto --squash --match-head-commit "${HEAD_SHA}" "${PR_URL}"
+
+  disable-auto-merge:
+    if: >-
+      always() &&
+      needs.authorize-dependency-update.result != 'success' &&
+      github.event.repository.fork == false &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (startsWith(github.event.pull_request.head.ref, 'dependabot/npm_and_yarn/') ||
+      startsWith(github.event.pull_request.head.ref, 'dependabot/github_actions/')) &&
+      github.event.pull_request.base.ref == github.event.repository.default_branch
+    needs: authorize-dependency-update
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Disable an existing auto-merge request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          set -euo pipefail
+          auto_merge_enabled="$(gh pr view "${PR_URL}" --json autoMergeRequest --jq '.autoMergeRequest != null')"
+          if [[ "${auto_merge_enabled}" == true ]]; then
+            gh pr merge --disable-auto "${PR_URL}"
+          else
+            echo "Auto-merge is not enabled."
+          fi

.github/workflows/prek-autoupdate-auto-merge.yml

@@ -0,0 +1,83 @@
+name: prek Autoupdate auto-merge
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+concurrency:
+  group: prek-autoupdate-auto-merge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  verify-prek-update:
+    if: >-
+      github.event.repository.fork == false &&
+      github.actor == 'prek-autoupdate-bot' &&
+      github.event.pull_request.user.login == 'prek-autoupdate-bot' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.head.ref == 'chore/prek-updates' &&
+      github.event.pull_request.base.ref == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Verify that only a native prek config changed
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          changed_files="$(gh api --paginate \
+            "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" \
+            --jq '.[].filename')"
+          case "${changed_files}" in
+            prek.toml | .pre-commit-config.yaml) ;;
+            *)
+              echo "Refusing auto-merge; changed files were:"
+              echo "${changed_files}"
+              exit 1
+              ;;
+          esac
+
+  enable-auto-merge:
+    needs: verify-prek-update
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Enable auto-merge
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr merge --auto --squash --match-head-commit "${HEAD_SHA}" "${PR_URL}"
+
+  disable-auto-merge:
+    if: >-
+      always() &&
+      needs.verify-prek-update.result != 'success' &&
+      github.event.repository.fork == false &&
+      github.event.pull_request.user.login == 'prek-autoupdate-bot' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.head.ref == 'chore/prek-updates' &&
+      github.event.pull_request.base.ref == github.event.repository.default_branch
+    needs: verify-prek-update
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Disable an existing auto-merge request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          set -euo pipefail
+          auto_merge_enabled="$(gh pr view "${PR_URL}" --json autoMergeRequest --jq '.autoMergeRequest != null')"
+          if [[ "${auto_merge_enabled}" == true ]]; then
+            gh pr merge --disable-auto "${PR_URL}"
+          else
+            echo "Auto-merge is not enabled."
+          fi

.github/workflows/prek_autoupdate.yml

@@ -18,6 +18,7 @@ concurrency:
 
 jobs:
   prek-autoupdate:
+    if: github.event.repository.fork == false
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -29,4 +30,6 @@ jobs:
         id: prek-autoupdate
         uses: Snuffy2/prek-autoupdate@v2
         with:
+          token: ${{ secrets.PREK_AUTOUPDATE_TOKEN }}
+          author-login: prek-autoupdate-bot
           update-day: "1"