move actions.yml additions to maven.yml

.github/workflows/actions.yml

@@ -1,13 +1,27 @@
-name: Comment when opened
+name: Dependabot auto-merge
-on:
+on: pull_request
-  issues:
+
-    types:
+permissions:
-      - opened
+  pull-requests: write
+  contents: write
+
 jobs:
-  comment:
+  dependabot:
+    permissions:
+      pull-requests: read
     runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'owner/my_repo'
     steps:
-      - run: gh issue comment $ISSUE --body "Thank you for opening this issue!"
+      - name: Dependabot metadata
+        id: dependabot-metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          alert-lookup: true
+          github-token: "${{ secrets.PAT_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        # if: (steps.dependabot-metadata.outputs.cvss == true && update_types == 'minor' || 'patch')
+        if: update_types == 'minor' || 'patch'
+        run: gh pr merge --auto --merge "$PR_URL"
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{github.event.pull_request.html_url}}
-          ISSUE: ${{ github.event.issue.html_url }}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/maven.yml

@@ -36,4 +36,23 @@ jobs:
           java-version: '8'
           distribution: 'corretto'
       - name: Check backwards compatibility of changes
-        run: .github/scripts/backwards_compatibility_check.sh
+        run: .github/scripts/backwards_compatibility_check.sh
+  auto-merge-vulnerable-PRs:
+    permissions:
+      pull-requests: read
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'owner/my_repo'
+    steps:
+      - name: Dependabot metadata
+        id: dependabot-metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          alert-lookup: true
+          github-token: "${{ secrets.PAT_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        # if: (steps.dependabot-metadata.outputs.cvss == true && update_types == 'minor' || 'patch')
+        if: update_types == 'minor' || 'patch'
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}