auto-merge.yml

name: Trigger auto-merge
on:
  push:
    branches: [master]
  # we use "pull_request_target" instead of "pull_request" so this event
  # works with dependabot pull requests. this is only the trigger to the
  # merge on all pull-requests. we still only merge in trusted pull-requests.
  pull_request_target:
    branches: [master]
    types:
      - opened
      - reopened
      - closed
      - synchronize
      - ready_for_review
      - converted_to_draft
jobs:
  auto-merge:
    # triggers on pushes to master, any actions on non-draft pull requests and when a pull-request is converted to a draft
    if: ${{ github.event_name == 'push' || !github.event.pull_request.draft || github.event.action == 'converted_to_draft' }}
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v3
        with:
          ref: master
          # bit confused about what credentials it normally persists and why
          # they don't work for us, but turning this to false works from experience
          persist-credentials: false
          # 0 means fetch all commits, which we need for merging
          fetch-depth: 0
      - run: 'scripts/auto_merge.py "${{ secrets.GITHUB_TOKEN }}"'
      # we use the AUTO_MERGE_BOT_TOKEN personal access token instead of
      # GITHUB_TOKEN so that the push triggers subsequent github action
      # workflows
      - run: git push "https://${{ secrets.AUTO_MERGE_BOT_TOKEN }}@github.com/${GITHUB_REPOSITORY}.git" 'HEAD:review' --force;