renovate-approve-merge.yml

# This workflow is provided via the organization template repository
#
# https://github.com/nextcloud/.github
# https://docs.github.com/en/actions/learn-github-actions/sharing-workflows-with-your-organization
#
# SPDX-FileCopyrightText: Nextcloud GmbH and Nextcloud contributors
# SPDX-License-Identifier: MIT

name: Auto approve renovate PRs

on:
  pull_request_target: # zizmor: ignore[dangerous-triggers]
    branches:
      - main
      - master
      - stable*

permissions:
  contents: read

concurrency:
  group: renovate-approve-merge-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

jobs:
  auto-approve-merge:
    if: github.event.pull_request.user.login == 'renovate[bot]'
    runs-on: ubuntu-latest-low
    permissions:
      # for hmarr/auto-approve-action to approve PRs
      pull-requests: write

    steps:
      - name: Disabled on forks
        if: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
        run: |
          echo 'Can not approve PRs from forks'
          exit 1

      - uses: mdecoleman/pr-branch-name@55795d86b4566d300d237883103f052125cc7508 # v3.0.0
        id: branchname
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      # GitHub actions bot approve
      - uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
        if: github.actor == 'renovate[bot]'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.head_ref }}

      # Enable GitHub auto merge
      - name: Enable Pull Request Automerge
        if: github.actor == 'renovate[bot]'
        run: gh pr merge --merge --auto
        env:
          GH_TOKEN: ${{ secrets.AUTOMERGE }}