github-shared-workflows/.github/workflows/pr-auto-merge.yml at master · clouddrove/github-shared-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
---
name: Automerge

on:
  workflow_call:
    inputs:
      tfcheck:
        description: 'Enter the tfcheck action name.'
        required: false
        type: string
      tfchecks_azure:
        description: 'List of Azure TF checks (JSON array as string)'
        required: false
        type: string
        default: '["pr-validation / 📝 Validate PR title", "pr-validation / 🧾 Validate Commit Messages", "tf-lint / tflint"]'
      azure_cloud:
        description: 'Enable Azure-specific checks'
        required: false
        type: boolean
        default: false
    secrets:
      GITHUB:
        description: 'GitHub Token'
        required: false

jobs:
  static-checks:
    name: Check Static Analysis
    runs-on: ubuntu-latest
    strategy:
      matrix:
        tf-checks: ["tf-lint / tflint", "tfsec / tfsec sarif report", "${{ inputs.tfcheck }}"]
    if: github.actor == 'dependabot[bot]' && !inputs.azure_cloud
    steps:
      - name: Wait for 2 Minutes
        run: sleep 120s
        shell: bash

      - name: Wait for "${{ matrix.tf-checks }}" to Succeed
        uses: lewagon/wait-on-check-action@v1.8.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          check-name: ${{ matrix.tf-checks }}
          repo-token: ${{ secrets.GITHUB || secrets.GITHUB_TOKEN }}
          wait-interval: 30
          allowed-conclusions: success

  static-checks-azure:
    name: Check Static Analysis for Azure
    runs-on: ubuntu-latest
    permissions:
      contents: read
      checks: read
      pull-requests: read
    if: |
      github.actor == 'dependabot[bot]' &&
      inputs.azure_cloud == true &&
      inputs.tfchecks_azure != '[]'
    strategy:
      matrix:
        tf-checks: ${{ fromJSON(inputs.tfchecks_azure) }}
    steps:
      - name: Wait for 2 Minutes
        run: sleep 120s
        shell: bash

      - name: Wait for "${{ matrix.tf-checks }}" to Succeed
        uses: lewagon/wait-on-check-action@v1.8.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          check-name: ${{ matrix.tf-checks }}
          repo-token: ${{ secrets.GITHUB || secrets.GITHUB_TOKEN }}
          wait-interval: 30
          allowed-conclusions: success

  autoapprove:
    permissions:
      contents: write
      pull-requests: write
    name: Auto Approve PRs by Dependabot
    needs: [static-checks]
    runs-on: ubuntu-latest
    if: |
      always() &&
      github.actor == 'dependabot[bot]' &&
      (needs.static-checks.result == 'success' || needs.static-checks-azure.result == 'success')  && !inputs.azure_cloud
    steps:
      - name: Approve PR via GitHub Bot
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

      - name: Approve PR via Anmol Nagpal
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB}}

  autoapprove-azure:
    permissions:
      contents: write
      pull-requests: write
    name: Auto Approve PRs by Dependabot
    needs: [static-checks-azure]
    runs-on: ubuntu-latest
    if: |
      always() &&
      github.actor == 'dependabot[bot]' &&
      (needs.static-checks.result == 'success' || needs.static-checks-azure.result == 'success') &&
      inputs.azure_cloud == true
    steps:
      - name: Approve PR via GitHub Bot
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

      - name: Approve PR via Anmol Nagpal
        run: gh pr review --approve "$PR_URL"
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GITHUB_TOKEN: ${{secrets.GITHUB}}

  automerge-azure:
    runs-on: ubuntu-latest
    needs: autoapprove-azure
    if: |
      always() &&
      needs.autoapprove-azure.result == 'success' &&
      github.event_name == 'pull_request' &&
      github.event.pull_request.draft == false &&
      inputs.azure_cloud == true
    steps:
      - name: Automerge
        uses: pascalgn/automerge-action@v0.16.4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB }}
          MERGE_FILTER_AUTHOR: 'dependabot[bot]'
          MERGE_METHOD: "merge"
          MERGE_DELETE_BRANCH: "true"
          MERGE_LABELS: "dependencies"
          MERGE_REQUIRED_APPROVALS: ""
  automerge:
    runs-on: ubuntu-latest
    needs: autoapprove
    if: |
      always() &&
      needs.autoapprove.result == 'success' &&
      github.event_name == 'pull_request' &&
      github.event.pull_request.draft == false && !inputs.azure_cloud
    steps:
      - name: Automerge
        uses: pascalgn/automerge-action@v0.16.4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB }}
          MERGE_FILTER_AUTHOR: 'dependabot[bot]'
          MERGE_METHOD: "merge"
          MERGE_DELETE_BRANCH: "true"
          MERGE_LABELS: "dependencies, github_actions"
          MERGE_REQUIRED_APPROVALS: ""
...