ci: enable auto-merging of dependabot PRs

.github/workflows/auto-merge.yml

@@ -0,0 +1,74 @@
+name: Auto-Merge Dependabot PRs (only for changes to minor or patch version but not major version)
+
+on:
+    pull_request:
+        types:
+            - labeled # Triggered when a label is added to a pull request
+
+jobs:
+    auto-merge:
+        if: github.actor == 'dependabot[bot]' # Ensures this only runs for Dependabot PRs
+        runs-on: ubuntu-latest
+        steps:
+            - name: Check if the PR has the 'dependencies' label
+              uses: actions/github-script@v6
+              id: check-label
+              with:
+                  script: |
+                      const { context } = require('@actions/github');
+                      const { labels } = context.payload.pull_request;
+
+                      // When dependabot creates PRs, it adds 'dependencies' as a label to the PRs.
+                      // Here we check to see if 'dependencies' label is present
+                      const hasDependenciesLabel = labels.some(label => label.name === 'dependencies');
+
+                      if (!hasDependenciesLabel) {
+                        core.setFailed("The 'dependencies' label is missing.");
+                      }
+
+            - name: Fetch Dependabot metadata
+              id: metadata
+              uses: dependabot/fetch-metadata@v2
+
+            - name: Check if update is a minor or patch group or individual minor/patch update
+              run: |
+                  if [[ "${{ steps.metadata.outputs.update-type }}" != "minor" && \
+                        "${{ steps.metadata.outputs.update-type }}" != "patch" && \
+                        "${{ github.event.pull_request.title }}" != *"minor-and-patch group"* ]]; then
+                    echo "This PR is not a minor or patch update. Auto-merge aborted."
+                    exit 1
+                  fi
+
+            - name: Check if CI passed
+              uses: actions/github-script@v6
+              with:
+                  script: |
+                      const { context, github } = require('@actions/github');
+                      const { pull_request } = context.payload;
+
+                      // Ensure that all other PR job statuses have passed (e.g. build, test, lint, etc)
+                      const { data: statuses } = await github.rest.repos.getCombinedStatusForRef({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        ref: pull_request.head.sha,
+                      });
+
+                      const allStatusesSuccessful = statuses.statuses.every(status => status.state === 'success');
+
+                      if (!allStatusesSuccessful) {
+                        core.setFailed("Not all CI checks passed.");
+                      }
+
+            - name: Auto-Merge PR
+              uses: actions/github-script@v6
+              with:
+                  script: |
+                      const { context, github } = require('@actions/github');
+                      const { pull_request } = context.payload;
+
+                      await github.rest.pulls.merge({
+                        owner: context.repo.owner,
+                        repo: context.repo.repo,
+                        pull_number: pull_request.number,
+                        merge_method: "squash", // other options are "merge" or "rebase"
+                      });