dependabot-automerge.yml

# Dependabot Auto-Merge Workflow
#
# Merges Dependabot PRs to `dev` after EVERY check completes clean.
# - Minor/patch version updates: eligible (low risk)
# - GitHub Actions non-major updates: eligible
# - Major updates: require manual review (breaking changes)
#
# ADR181 R2b (2026-07-30): `gh pr merge --auto` is BANNED repo-wide — the
# #392 scar proved it merges past failing NON-required checks. This job
# instead waits for every other check to complete (bounded poll, Power-of-10
# rule 2), refuses on ANY failure — required or not — and only then merges.

name: Dependabot Auto-Merge

on:
  pull_request:
    branches:
      - dev # Only trigger for PRs targeting dev

permissions:
  contents: write
  pull-requests: write

jobs:
  dependabot-automerge:
    name: Auto-merge Dependabot PRs
    runs-on: ubuntu-latest
    # Bounded wait: 40 polls x 60s inside a hard job ceiling.
    timeout-minutes: 45
    if: github.actor == 'dependabot[bot]'

    steps:
      - name: Fetch Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v3
        with:
          github-token: "${{ secrets.GITHUB_TOKEN }}"

      - name: Log update details
        run: |
          echo "Dependency: ${{ steps.metadata.outputs.dependency-names }}"
          echo "Update type: ${{ steps.metadata.outputs.update-type }}"
          echo "Ecosystem: ${{ steps.metadata.outputs.package-ecosystem }}"
          echo "Previous version: ${{ steps.metadata.outputs.previous-version }}"
          echo "New version: ${{ steps.metadata.outputs.new-version }}"

      # One merge path for every eligible class: wait for all OTHER checks,
      # refuse on any failure (required or not), then a plain --squash merge.
      - name: Wait for all checks, refuse on any failure, then merge
        if: |
          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
          steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
          (steps.metadata.outputs.package-ecosystem == 'github_actions' &&
           steps.metadata.outputs.update-type != 'version-update:semver-major')
        run: |
          SELF="Auto-merge Dependabot PRs"
          for i in $(seq 1 40); do
            checks=$(gh pr checks "$PR_URL" --json name,bucket 2>/dev/null || echo '[]')
            failed=$(jq --arg self "$SELF" \
              '[.[] | select(.bucket == "fail" and .name != $self)] | length' <<<"$checks")
            pending=$(jq --arg self "$SELF" \
              '[.[] | select(.bucket == "pending" and .name != $self)] | length' <<<"$checks")
            if [ "$failed" -gt 0 ]; then
              gh pr comment "$PR_URL" --body \
                "Auto-merge REFUSED: $failed check(s) failed. ADR181 R2b — a \
          failing check blocks the merge even when non-required (the #392 class)."
              exit 1
            fi
            if [ "$pending" -eq 0 ] && [ "$checks" != "[]" ]; then
              echo "All checks complete and clean — merging."
              gh pr merge --squash "$PR_URL"
              exit 0
            fi
            echo "poll $i/40: $pending check(s) still pending"
            sleep 60
          done
          echo "Checks did not complete inside the wait budget — NOT merging."
          exit 1
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # MAJOR updates require manual review - just add a comment
      - name: Comment on major updates
        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
        run: |
          gh pr comment "$PR_URL" --body \
            "**Major version update** - may contain breaking changes. Manual review required."
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}