mesh-2816: automate dependabot

.dependabot/config.yml

@@ -1,23 +1,16 @@
-version: 1
-update_configs:
+version: 2
+updates:
   - package_manager: "javascript"
     directory: "/"
-    update_schedule: "live"
-    automerged_updates:
-      - match:
-          dependency_type: "all"
-          update_type: "security:patch"
+    schedule:
+      interval: "daily"
+
   - package_manager: "javascript"
     directory: "/sandbox"
-    update_schedule: "live"
-    automerged_updates:
-      - match:
-          dependency_type: "all"
-          update_type: "security:patch"
+    schedule:
+      interval: "daily"
+
   - package_manager: "python"
     directory: "/"
-    update_schedule: "live"
-    automerged_updates:
-      - match:
-          dependency_type: "all"
-          update_type: "security:patch"
+    schedule:
+      interval: "daily"

.github/CODEOWNERS

@@ -1 +1,8 @@
 * @alisonkinloch-nhs @matt-mercer @nhsdigital/mesh-to-cloud-admins
+
+# Exempt for dependabot PRs
+
+poetry.lock
+pyproject.toml
+.github/workflows/*.yml
+.github/workflows/*.yaml

.github/workflows/dependabot-auto-merge.yaml

@@ -0,0 +1,37 @@
+name: Auto-merge Dependabot PRs
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+      - labeled
+
+jobs:
+  enable-automerge:
+    # Only run on Dependabot PRs
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 #v3.0.0  
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Auto-approve Dependabot PR
+        uses: hmarr/auto-approve-action@8f929096a962e83ccdfa8afcf855f39f12d4dac7 # v4
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for Dependabot PRs
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-lint.yaml

@@ -1,5 +1,7 @@
 name: PR Quality Check
 on: pull_request
+permissions:
+  pull-requests: write
 jobs:
   link-ticket:
     runs-on: ubuntu-latest
@@ -20,10 +22,36 @@ jobs:
 
       - name: Comment on PR
         if: contains(github.event.pull_request.head.ref, 'apm-') || contains(github.event.pull_request.head.ref, 'APM-') || contains(github.event.pull_request.head.ref, 'mesh-') || contains(github.event.pull_request.head.ref, 'MESH-') || contains(github.event.pull_request.head.ref, 'mesh2cloud-') || contains(github.event.pull_request.head.ref, 'MESH2CLOUD-') || contains(github.event.pull_request.head.ref, 'spii-') || contains(github.event.pull_request.head.ref, 'SPII-') || contains(github.event.pull_request.head.ref, 'spinecore-') || contains(github.event.pull_request.head.ref, 'SPINECORE-')
-        uses: unsplash/comment-on-pr@b5610c6125a7197eaec80072ea35ef53e1fc6035  # v1.3.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: actions/github-script@v7
         with:
-          msg: |
-            This branch is work on a ticket in the NHS Digital AMB JIRA Project. Here's a handy link to the ticket:
-            # [${{ env.TICKET_NAME }}](https://jira.digital.nhs.uk/browse/${{ env.TICKET_NAME}})
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const marker = '<!-- jira-ticket-link -->';
+            const body = `${marker}\nThis branch is work on a ticket in the NHS Digital AMB JIRA Project. Here's a handy link to the ticket:\n# [${process.env.TICKET_NAME}](https://jira.digital.nhs.uk/browse/${process.env.TICKET_NAME})`;
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+
+            const existing = comments.find((comment) =>
+              comment.user?.type === 'Bot' && comment.body?.includes(marker)
+            );
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }