Bump frequenz-repo-config[lib] from 0.13.5 to 0.14.0 #31
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Auto-merge Dependabot PR | |
| on: | |
| # XXX: !!! SECURITY WARNING !!! | |
| # pull_request_target has write access to the repo, and can read secrets. We | |
| # need to audit any external actions executed in this workflow and make sure no | |
| # checked out code is run (not even installing dependencies, as installing | |
| # dependencies usually can execute pre/post-install scripts). We should also | |
| # only use hashes to pick the action to execute (instead of tags or branches). | |
| # For more details read: | |
| # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ | |
| pull_request_target: | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| auto-merge: | |
| if: github.actor == 'dependabot[bot]' | |
| runs-on: ubuntu-slim | |
| steps: | |
| - name: Generate GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1 | |
| with: | |
| app-id: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_ID }} | |
| private-key: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_PRIVATE_KEY }} | |
| - name: Auto-merge Dependabot PR | |
| uses: frequenz-floss/dependabot-auto-approve@ada24053062e8199b27ab90890f6f21b48824864 # PR #3 | |
| with: | |
| github-token: ${{ steps.app-token.outputs.token }} | |
| dependency-type: 'all' | |
| auto-merge: 'true' | |
| merge-method: 'merge' | |
| add-label: 'tool:auto-merged' |