name: Dependabot auto-merge

# Auto-enables GitHub's native auto-merge on Dependabot PRs that match
# our safety bands, so they merge themselves once CI passes. CI is the
# real safety net here: every auto-merge still has to pass Lint & Build
# and Validate SVG. The classification below is just about which bumps
# we never want a human to gate on.
#
# Auto-merged:
#   - Any patch update (runtime or dev)
#   - Any minor update (runtime or dev) — CI catches the rest
#   - Any update on a dev-only dependency, including majors (we'll catch
#     real breakage in Lint & Build before it can hit anyone)
#   - Any GitHub Actions bump
#
# Labeled needs-review (human merges):
#   - Production major bumps only — the one class that warrants reading
#     the release notes before shipping
#
# This tier matters for autonomous-mode: nobody should need to babysit
# the repo for routine dependency updates.

on:
  pull_request:
    types: [opened, reopened, synchronize, ready_for_review]

permissions:
  contents: write
  pull-requests: write

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.event.pull_request.user.login == 'dependabot[bot]' && !github.event.pull_request.draft
    steps:
      - name: Fetch dependency metadata
        id: meta
        uses: dependabot/fetch-metadata@v3
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Enable auto-merge on safe updates
        if: |
          steps.meta.outputs.update-type == 'version-update:semver-patch' ||
          steps.meta.outputs.update-type == 'version-update:semver-minor' ||
          steps.meta.outputs.dependency-type == 'direct:development' ||
          steps.meta.outputs.package-ecosystem == 'github_actions' ||
          steps.meta.outputs.package-ecosystem == 'github-actions'
        run: gh pr merge --auto --squash --delete-branch "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Label production majors for manual review
        if: |
          steps.meta.outputs.update-type == 'version-update:semver-major' &&
          steps.meta.outputs.dependency-type == 'direct:production'
        run: |
          gh label create "needs-review" \
            --color "fbca04" \
            --description "Dependabot production major bump; needs human review" \
            --repo "$GITHUB_REPOSITORY" \
            2>/dev/null || true
          gh pr edit "$PR_URL" --add-label "needs-review"
          gh pr comment "$PR_URL" --body "This is a major bump on a production dependency. Not auto-merging — release notes worth a read first."
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}